VMSA-2020-0023 : VMware ESXi, Workstation, Fusion and NSX-T updates address multiple security vulnerabilities

a. ESXi OpenSLP remote code execution vulnerability CVE-2020-3992 OpenSLP as used in ESXi has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remo...

CVE-2020-3981

VMware ESXi 7.0 before ESXi7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG, Workstation 15.x, Fusion 11.x before 11.5.6 contain an out-of-bounds read vulnerability due to a time-of-check time-of-use issue in ACPI device. A malicious actor with administrative...

Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Microsoft

PoC exploit for CVE-2020-1048. It is an exploit targeting a bina...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Missing Permission Check on Time Tracking Cross-Site Scripting in PyPi Files API Insecure Authorization Check on Private Project Security Dashboard Cross-Site Scripting in References Cross-Site Scripting in Group Names Cross-Site Scripting in Blob Viewer Cross-Site Scripting in...

Race condition

In InstallPackage of package.cpp, there is a possible bypass of a signature check due to a Time of Check/Time of Use condition. This could lead to local escalation of privilege by allowing a bypass of the initial zip file signature check for an OS update with no additional execution privileges...

Open-Xchange: SSRF protection bypass in /appsuite/api/oxodocumentfilter addfile action

Summary The URL validation logic applied when handling /appsuite/api/oxodocumentfilter&action=addfile suffers from three defects which can be used to execute Time of Check Time of Use ToCToU SSRF attack. This issue allows malicious actors to execute HTTP GET requests on internal network services...

CVE-2020-8833

The CVE-2020-8833 issue affects Ubuntu’s Apport crash-report handling. A Time-of-check Time-of-use race between os.open and os.chown can allow a local attacker to change crash-file ownership to root when fs.protected_symlinks is disabled, via a symlink with the same name as a deleted file. The fi...

CVE-2020-0003

In onCreate of InstallStart.java, there is a possible package validation bypass due to a time-of-check time-of-use vulnerability. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions...

CVE-2020-0003

CVE-2020-0003 affects Android 8.0 when the framework’s InstallStart.java onCreate contains a time‑of‑check time‑of‑use packaging validation bypass. The issue could allow a local elevation of privilege with user interaction required, via a vulnerability in the Android Framework. Public details ind...

Splitting atoms in XNU

Posted by Ian Beer, Google Project Zero TL;DR A locking bug in the XNU virtual memory subsystem allowed violation of the preconditions required for the correctness of an optimized virtual memory operation. This was abused to create shared memory where it wasn't expected, allowing the creation of ...

VMware Workstation 14.x < 14.1.7 / 15.x < 15.0.4 Multiple Vulnerabilities (VMSA-2019-0005)

The version of VMware Workstation installed on the remote host is 14.x prior to 14.1.4 or 15.x prior to 15.0.1. It is, therefore, affected by multiple vulnerabilities, including: - An out-of-bounds read/write vulnerability and a Time-of-check Time-of-use TOCTOU vulnerability in the virtual USB 1....

CVE-2019-7347

A Time-of-check Time-of-use TOCTOU Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deletion from the users table. This allows a nonexistent user to access and modify records add/delete Monitors, Users, etc...

Race condition

A Time-of-check Time-of-use TOCTOU Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deletion from the users table. This allows a nonexistent user to access and modify records add/delete Monitors, Users, etc...

Design/Logic Flaw

In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and would also allow one user of the system who didn't have root access to tamper with another's installs...

CVE-2019-7249

In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and would also allow one user of the system who didn't have root access to tamper with another's installs...

CVE-2019-7249

In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and would also allow one user of the system who didn't have root access to tamper with another's installs...

CVE-2019-7249

CVE-2019-7249 affects Keybase on macOS prior to version 2.12.6. The vulnerability arises in the move RPC to the Helper, described as a time-to-check-time-to-use issue that could allow a user without root to tamper with another user's installations. NVD metrics indicate a high/critical impact (CVS...

McAfee True Key - McAfee.TrueKey.Service Privilege Escalation Vulnerability

Exploit for windows platform in category local exploits McAfee True Key: Multiple Issues with McAfee.TrueKey.Service Implementation Platform: Version 5.1.173.1 on Windows 10 1809. Class: Elevation of Privilege Summary: There are multiple issues in the implementation of the McAfee.TrueKey.Service...

CVE-2017-12410

It is possible to exploit a Time of Check & Time of Use TOCTOU vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of...

Kaseya Virtual System Administrator (VSA) Local Privilege Escalation

Hey, The Local Privilege Escalation vulnerability was found in the Kaseya Virtual System Administrator VSA 1 agent "AgentMon.exe". The agent is a Windows service that periodically executes various programs with aNT AUTHORITY\SYSTEMa privileges. In the Kaseya's default configuration, Windows users...