MLflow's excessive directory permissions allow local privilege escalation

Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf MLflow API is called...

GHSA-QPGC-W4MG-6V92 MLflow's excessive directory permissions allow local privilege escalation

Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf MLflow API is called...

CVE-2024-27134

Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf MLflow API is called...

PYSEC-2024-224

Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf MLflow API is called...

CVE-2024-27134 Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf

Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf MLflow API is called...

CVE-2024-27134 Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf

Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf MLflow API is called...

CVE-2024-27134 Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf

Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf MLflow API is called...

CVE-2024-27134

CVE-2024-27134 : Multiple connected sources confirm a vulnerability in MLflow’s spark_udf API where excessive directory permissions allow a local attacker to achieve privilege escalation via a ToCToU attack. Affected: MLflow (spark_udf path) with local execution context. Root cause: insufficient ...

Exploit for Race Condition in Apple Ipados

macOS LPE CVE-2023-32413 / ZDI-23-845 / Pwn2Own Vancouver 202...

CVE-2024-22185

CVE-2024-22185 is a time-of-check/time-of-use race condition in Intel ACTM (Alias Checking Trusted Module) potentially enabling local privilege escalation. The advisory and Red Hat/Intel sources indicate this affects certain Intel Xeon processor families and is mitigated through firmware updates ...

CVE-2024-51563

The virtiovqrecordon function is subject to a time-of-check to time-of-use TOCTOU race condition...

CVE-2024-51563 bhyve(8) virtio_vq_recordon time-of-check to time-of-use race

The virtiovqrecordon function is subject to a time-of-check to time-of-use TOCTOU race condition...

CVE-2024-51563

CVE-2024-51563 is a TOCTOU race in bhyve's virtio_vq_recordon function. FreeBSD advisory SA-24:17.bhyve documents multiple bhyve issues and confirms that exploitation can lead to DoS of the bhyve host and potential memory access among guests. The vulnerability is among issues fixed by FreeBSD pat...

CVE-2024-51563 bhyve(8) virtio_vq_recordon time-of-check to time-of-use race

The virtiovqrecordon function is subject to a time-of-check to time-of-use TOCTOU race condition...

Security Bulletin: IBM Sterling Connect:Direct Web Services is affected by PostgreSQL TOCTOU vulnerability

Summary IBM Sterling Connect:Direct Web Services uses PostgreSQL, PostgreSQL could allow a remote authenticated attacker to gain elevated privileges on the system, caused by a tme-of-check time-of-use TOCTOU race condition in pgdump. Vulnerability Details CVEID:CVE-2024-7348 DESCRIPTION: PostgreS...

Time-of-check Time-of-use (TOCTOU) Race Condition

NVIDIA Container Toolkit is vulnerable to Time-of-Check Time-of-Use TOCTOU Race Condition. The vulnerability is due to a TOCTOU flaw in the default configuration, where a specifically crafted container image may gain unauthorized access to the host file system. This can lead to code execution,...

GO-2024-3239 NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability in github.com/NVIDIA/nvidia-container-toolkit

NVIDIA Container Toolkit contains a Time-of-check Time-of-Use TOCTOU vulnerability in github.com/NVIDIA/nvidia-container-toolkit...

CVE-2024-38407 Time-of-check Time-of-use (TOCTOU) Race Condition in Camera

Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver...

CVE-2024-38406 Time-of-check Time-of-use (TOCTOU) Race Condition in Camera

Memory corruption while handling IOCTL calls in JPEG Encoder driver...

CVE-2024-38406 Time-of-check Time-of-use (TOCTOU) Race Condition in Camera

Memory corruption while handling IOCTL calls in JPEG Encoder driver...