CVE-2020-3808

Adobe Creative Cloud Desktop (Windows) is affected by CVE-2020-3808: a time‑of‑check to time‑of‑use (TOCTOU) race condition in versions 5.0 and earlier that can lead to arbitrary file deletion. The issue is documented in APSB20-11; a fix is available in 5.1.x (e.g., 5.1.0.407 as referenced by Nes...

CVE-2020-3808: Time-of-check Time-of-use (TOCTOU) Race Condition

Creative Cloud Desktop Application versions 5.0 and earlier have a time-of-check to time-of-use toctou race condition vulnerability. Successful exploitation could lead to arbitrary file deletion...

Critical Adobe Flaw Fixed in Out-of-Band Security Update

Adobe has released an out-of-band patch for a critical vulnerability in its Creative Cloud Desktop Application for Windows. The flaw can be exploited by an attacker to delete specific arbitrary files on the victim’s system. Creative Cloud acts as a central console for desktop users to quickly...

CVE-2019-20610: Time-of-check Time-of-use (TOCTOU) Race Condition

An issue was discovered on Samsung mobile devices with N7.X and O8.X Exynos 7570, 7870, 7880, 7885, 8890, 8895, and 9810 chipsets software. A double-fetch vulnerability in Trustlet allows arbitrary TEE code execution. The Samsung ID is SVE-2019-13910 April 2019...

PT-2020-6361

Name of the Vulnerable Software and Affected Versions Adobe Creative Cloud Desktop Application versions 5.0 and earlier Description The issue is caused by a time-of-check to time-of-use toctou race condition. Successful exploitation could lead to arbitrary file deletion. This can be exploited by ...

CVE-2020-8873: Time-of-check Time-of-use (TOCTOU) Race Condition

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists withi...

VMware Fusion USB Arbitrator Setuid Privilege Escalation

This exploits an improper use of setuid binaries within VMware Fusion 10.1.3 - 11.5.3. The Open VMware USB Arbitrator Service can be launched outide of its standard path which allows loading of an attacker controlled binary. By creating a payload in the user home directory in a specific folder, a...

CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

DEBIAN-CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

Design/Logic Flaw

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

CVE-2019-15608

The CVE-2019-15608 issue is a TOCTOU race condition in Yarn where the package hash is computed before writing to the cache and not recomputed on read, enabling potential cache pollution. Connected sources confirm this affects Yarn versions older than 1.19.0 and that a fix exists in 1.19.0. Photon...

CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

CVE-2019-15608: Time-of-check Time-of-use (TOCTOU) Race Condition

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apple Ipados

r00kie-kr00kie Disclaimer This is a PoC exploit for...

Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apple Ipados

kr00k PoC of CVE-2019-15126 kr00k vulnerability Installati...

PT-2020-9730

Name of the Vulnerable Software and Affected Versions yarn versions prior to 1.19.0 Description The issue concerns a TOCTOU vulnerability in the package integrity validation. This vulnerability occurs because the hash is computed before writing a package to the cache, but it is not computed again...

CVE-2020-8793: Time-of-check Time-of-use (TOCTOU) Race Condition

OpenSMTPD before 6.6.4 allows local users to read arbitrary files e.g., on some Linux distributions because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c...