GHSA-F62V-XPXF-3V68 Code injection in Apache Ant

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the...

Code injection in Apache Ant

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the...

Huawei EulerOS: Security Advisory for ant (EulerOS-SA-2021-1133)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : ant (EulerOS-SA-2021-1133)

According to the version of the ant packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to...

Security Bulletin: Apache Ant as used by IBM QRadar SIEM is vulnerable to Insecure Temporary Files (CVE-2020-11979)

Summary Apache Ant as used by IBM QRadar SIEM is vulnerable to Insecure Temporary Files Vulnerability Details CVEID: CVE-2020-11979 DESCRIPTION: Apache Ant could allow a remote authenticated attacker to bypass security restrictions, caused by an insecure temporary file flaw. By sending a...

Security Bulletin: Vulnerability in Apache Ant affects IBM Spectrum Symphony

Summary These interim fixes provide instructions on upgrading Apache Ant to 1.10.9 in IBM Spectrum Symphony 7.2.0.2, IBM Spectrum Symphony 7.2.1, IBM Spectrum Symphony 7.3, and IBM Spectrum Symphony 7.3.1 in order to address security vulnerability CVE-2020-11979 in Apache Ant. Vulnerability Detai...

Apache Flink 1.11.0 Arbitrary File Read / Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Flink File Read Vulnerability', 'Description' = %q This module exploits an unauthenticated directory traversal vulnerability in Apache Fli...

Apache Flink 1.11.0 - Unauthenticated Arbitrary File Read (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Flink File Read Vulnerability', 'Description' = %q This module exploits an unauthenticated directory traversal vulnerability in Apache Fli...

Security Bulletin: Gradle version in IBP javaenv and dind images depends on vulnerable Apache Ant

Summary Versions of IBP images javaenv and dind before 2.5.1 release on 12082020 included a version of gradle that depended upon vulnerable Apache libraries. Gradle is a build system, intended to aid in building chaincode, though not required for building chaincode. Vulnerability Details CVEID:...

[ASA-202012-5] ant: arbitrary code execution

Arch Linux Security Advisory ASA-202012-5 ========================================= Severity: Medium Date : 2020-12-05 CVE-ID : CVE-2020-11979 Package : ant Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1312 Summary ======= The package ant before version...

CVE-2020-11979

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the...

File Upload Vulnerability in the Backend of Code Ant Achievement Management System

Code Ant Achievement Management System is an elementary school achievement statistics system that focuses on optimizing achievement collection methods and enriching the dimensions of achievement analysis. A file upload vulnerability exists in the backend of Code Ant Achievement Management System,...

GLSA-202011-18 : Apache Ant: Insecure temporary file

The remote host is affected by the vulnerability described in GLSA-202011-18 Apache Ant: Insecure temporary file A previous fix for a security vulnerability involving insecure temporary files has been found to be incomplete. Impact : A local attacker could perform symlink attacks to overwrite...

Apache Ant: Insecure temporary file

Background Ant is a Java-based build tool similar to ‘make’ that uses XML configuration files. Description A previous fix for a security vulnerability involving insecure temporary files has been found to be incomplete. Impact A local attacker could perform symlink attacks to overwrite arbitrary...

Stored Cross-Site Scripting Vulnerability in Ant Notes

Ant Notes is a cloud notes software, cross-platform, support markdown format, support for web, PC, mobile APP client, and WeChat version, support for generating public blogs and PDF. Ant Notes has a stored cross-site scripting vulnerability. Attackers can use the vulnerability to obtain sensitive...

About the security content of Safari 14.0.1

About the security content of Safari 14.0.1 This document describes the security content of Safari 14.0.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

Over 2800 e-Shops Running Outdated Magento Software Hit by Credit Card Hackers

A wave of cyberattacks against retailers running the Magento 1.x e-commerce platform earlier this September has been attributed to one single group, according to the latest research. "This group has carried out a large number of diverse Magecart attacks that often compromise large numbers of...

ant: insecure temporary file vulnerability

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build...

Moderate: Red Hat Security Advisory: Red Hat Process Automation Manager 7.9.0 security update

An update is now available for Red Hat Process Automation Manager. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

ant: insecure temporary file vulnerability

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build...