Authorization

External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use TOCTOU weakness, involving the JDK DNS cache. Attackers that were timing DNS cache expiry correctly were able to inject configuration that would bypass existing network deny-lists. Attackers could...

CVE-2023-26438

CVE-2023-26438 describes a time-of-check/time-of-use (TOCTOU) weakness in external service lookups tied to the JDK DNS cache. Attackers timing DNS cache expiry could inject configurations to bypass existing network deny-lists and discover restricted infrastructure or service availability. The cor...

CVE-2023-26438

External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use TOCTOU weakness, involving the JDK DNS cache. Attackers that were timing DNS cache expiry correctly were able to inject configuration that would bypass existing network deny-lists. Attackers could...

CVE-2023-26438: Server-Side Request Forgery (SSRF)

External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use TOCTOU weakness, involving the JDK DNS cache. Attackers that were timing DNS cache expiry correctly were able to inject configuration that would bypass existing network deny-lists. Attackers could...

Fedora 37 : curl (2023-189272bcce)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-189272bcce advisory. - libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called stat followed by fopen in a way that made it vulnerable t...

OESA-2023-1443 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called stat followed by fopen in a way that made it...

Race Condition

libcurl.so is vulnerable to a Race Condition. The library is susceptible to a TOCTOU race condition when it saves cookies, HSTS, and alt-svc data to a file. A victim might use the data for an intended purpose, but an attacker may overwrite the protected file...

Debian DSA-5460-1 : curl - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5460 advisory. - libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called stat followed by fopen in a way that made it vulnerable to a TOCTOU rac...

CVE-2023-32001

Removed by vendor...

Curl Arbitrary File Write 7.x >= 7.84.0 / 8.x <= 8.1.2 (CVE-2023-32001)

The version of Curl installed on the remote host is between 7.84.0 and 8.1.2. It is therefore affected by an arbitrary file write vulnerability. Curl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called stat followed by fopen in a way that made it vulnerable t...

Cisco NX-OS Software Remote Package Manager Command Injection (CVE-2019-1732)

A vulnerability in the Remote Package Manager RPM subsystem of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to leverage a time-of-check, time-of-use TOCTOU race condition to corrupt local variables, which could lead to arbitrary command injectio...

SUSE: Security Advisory (SUSE-SU-2023:2880-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2023:2891-1 Security update for curl

This update for curl fixes the following issues: - CVE-2023-32001: Fixed TOCTOU race condition bsc1213237...

SUSE-SU-2023:2880-1 Security update for curl

This update for curl fixes the following issues: - CVE-2023-32001: Fixed TOCTOU race condition bsc1213237...

CVE-2023-33156: Time-of-check Time-of-use (TOCTOU) Race Condition

Microsoft Defender Elevation of Privilege Vulnerability...

CVE-2023-33154: Time-of-check Time-of-use (TOCTOU) Race Condition

Windows Partition Management Driver Elevation of Privilege Vulnerability...

CVE-2023-35311: Time-of-check Time-of-use (TOCTOU) Race Condition

Microsoft Outlook Security Feature Bypass Vulnerability...

CVE-2023-26299

A potential Time-of-Check to Time-of-Use TOCTOU vulnerability has been identified in certain HP PC products using AMI UEFI Firmware system BIOS, which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability...

Design/Logic Flaw

A potential Time-of-Check to Time-of-Use TOCTOU vulnerability has been identified in certain HP PC products using AMI UEFI Firmware system BIOS, which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability...

CVE-2023-26299

CVE-2023-26299 describes a potential TOCTOU vulnerability in HP PCs that use AMI UEFI firmware (system BIOS), which could allow arbitrary code execution. The issue stems from how TOCTOU could be exploited on affected systems, with HP/AMI providing mitigations via firmware updates. Connected docum...