PT-2022-16163

Name of the Vulnerable Software and Affected Versions B2 Command Line Tool versions 3.2.0 and below Description The B2 Command Line Tool contains a key disclosure vulnerability that can be exploited by local attackers through a time-of-check-time-of-use TOCTOU race condition. The tool saves API...

PT-2022-16162

Name of the Vulnerable Software and Affected Versions b2-sdk-python versions 1.14.0 and below Description The b2-sdk-python library contains a key disclosure vulnerability that can be exploited by local attackers through a time-of-check-time-of-use TOCTOU race condition. This vulnerability affect...

CVE-2022-23653: Time-of-check Time-of-use (TOCTOU) Race Condition

B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a...

CVE-2022-23651: Time-of-check Time-of-use (TOCTOU) Race Condition

b2-sdk-python is a python library to access cloud storage provided by backblaze. Linux and Mac releases of the SDK version 1.14.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use TOCTOU race...

CVE-2021-22043

VMware ESXi contains a TOCTOU Time-of-check Time-of-use vulnerability that exists in the way temporary files are handled. A malicious actor with access to settingsd, may exploit this issue to escalate their privileges by writing arbitrary files...

Code injection

VMware ESXi contains a TOCTOU Time-of-check Time-of-use vulnerability that exists in the way temporary files are handled. A malicious actor with access to settingsd, may exploit this issue to escalate their privileges by writing arbitrary files...

CVE-2021-22043

VMware ESXi contains a TOCTOU Time-of-check Time-of-use vulnerability that exists in the way temporary files are handled. A malicious actor with access to settingsd, may exploit this issue to escalate their privileges by writing arbitrary files...

CVE-2021-22043

CVE-2021-22043 affects VMware ESXi. It is a TOCTOU vulnerability in how temporary files are handled by the settingsd service, enabling a user with access to settingsd to escalate privileges by writing arbitrary files. The issue is discussed alongside related flaws (CVE-2021-22040/22041/22042/2205...

CVE-2021-22043: Time-of-check Time-of-use (TOCTOU) Race Condition

VMware ESXi contains a TOCTOU Time-of-check Time-of-use vulnerability that exists in the way temporary files are handled. A malicious actor with access to settingsd, may exploit this issue to escalate their privileges by writing arbitrary files...

PT-2022-2229

Name of the Vulnerable Software and Affected Versions VMware ESXi affected versions not specified Description The issue is related to a TOCTOU Time-of-check Time-of-use vulnerability in the handling of temporary files. This can be exploited by a malicious actor with access to settingsd to escalat...

VMSA-2022-0004:VMware ESXi, Workstation, and Fusion updates address multiple security vulnerabilities

Advisory ID: VMSA-2022-0004 CVSSv3 Range: 5.3-8.4 Issue Date:2022-02-15 Updated On: 2022-02-15 Initial Advisory CVEs: CVE-2021-22040, CVE-2021-22041, CVE-2021-22042, CVE-2021-22043, CVE-2021-22050 Synopsis: VMware ESXi, Workstation, and Fusion updates address multiple security vulnerabilities...

CVE-2021-4098: Time-of-check Time-of-use (TOCTOU) Race Condition

Insufficient data validation in Mojo in Google Chrome prior to 96.0.4664.110 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page...

GHSA-C6RQ-RJC2-86V2 Time-of-check Time-of-use (TOCTOU) Race Condition in chownr

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks...

Time-of-check Time-of-use (TOCTOU) Race Condition in chownr

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks...

TOCTOU Race Condition in Yarn

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack. This issue is fixed in 1.19.0...

GHSA-HJXC-462X-X77J TOCTOU Race Condition in Yarn

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack. This issue is fixed in 1.19.0...

AlmaLinux 8 : kernel (ALSA-2021:1578)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:1578 advisory. - A memory leak in the sofsetgetlargectrldata function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of...

PT-2022-16618

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2021.2 Description The issue is related to a Time-of-check/Time-of-use TOCTOU race-condition attack in agent registration via XML-RPC. This type of attack occurs when there is a delay between the time of...

CVE-2022-23563: Time-of-check Time-of-use (TOCTOU) Race Condition

Tensorflow is an Open Source Machine Learning Framework. In multiple places, TensorFlow uses tempfile.mktemp to create temporary files. While this is acceptable in testing, in utilities and libraries it is dangerous as a different process can create the file between the check for the filename in...

Time-of-check Time-of-use (TOCTOU) Race Condition

As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a...