23252 matches found
CVE-2014-5000
The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process...
CVE-2014-4992
lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtain sensitive information by listing the process...
CVE-2014-5004
The CVE-2014-5004 issue affects the brbackup Ruby gem (version 0.1.1) where lib/brbackup.rb places the database password on the mysql command line. This exposes the password to local users who can list the process, enabling plaintext disclosure of credentials and partial confidentiality impact. E...
CVE-2014-5001
CVE-2014-5001 affects the Ruby gem kcapifony (version 2.1.6) via the file lib/ksymfony1.rb . The underlying issue is that the program places database user passwords on the command line for the tools mysqldump , pg_dump , mysql , and psql , which allows local users to obtain sensitive information ...
CVE-2014-4997
CVE-2014-4997 affects the Ruby point-cli gem (version 0.0.1). The issue is in lib/commands/setup.rb, where credentials are placed on the curl command line, allowing a local attacker to obtain sensitive information by listing the process. Impact is local plaintext credential disclosure; no remote ...
CVE-2014-4992
The CVE-2014-4992 issue affects the Cap-Strap gem for Ruby (version 0.1.5). The underlying flaw is that lib/cap-strap/helpers.rb places credentials on the useradd command line, making them observable in the process list by local users. This yields a local plaintext credential disclosure vulnerabi...
CVE-2014-4995
Vulnerability CVE-2014-4995 affects the VladTheEnterprising Ruby gem (version ~0.2); a race condition in lib/vlad/dba/mysql.rb allows local users to obtain the MySQL root password from a temporary file before it is removed. Related advisories describe insecure temporary file handling and potentia...
CVE-2014-4991
CVE-2014-4991 affects the Ruby gem codders-dataset (version 1.3.2.1). The vulnerability is in two files, lib/dataset/database/mysql.rb and lib/dataset/database/postgresql.rb, where credentials are placed on the mysqldump command line. This allows a local user to obtain sensitive information by li...
CVE-2014-4998
test/tcdatabase.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process...
CVE-2014-4993
1 lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and 2 lib/backup/cli/utility.rb in the backupchecksum gem 3.0.23 for Ruby place credentials on the openssl command line, which allows local users to obtain sensitive information by listing the process...
Improper Link Resolution Before File Access ('Link Following')
lib/vlad/dba/mysql.rb in the VladTheEnterprising gem for Ruby allows local users to write to arbitrary files via a symlink attack on /tmp/my.cnf.targethost...
CVE-2014-5000: Exposure of Sensitive Information to an Unauthorized Actor
The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process...
Code injection
clipedit in the Clipboard module for Perl allows local users to delete arbitrary files via a symlink attack on /tmp/clipedit$$...
CVE-2014-1859
1 core/tests/testmemmap.py, 2 core/tests/testmultiarray.py, 3 f2py/f2py2e.py, and 4 lib/tests/testio.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file...
CVE-2014-1859
1 core/tests/testmemmap.py, 2 core/tests/testmultiarray.py, 3 f2py/f2py2e.py, and 4 lib/tests/testio.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file...
PYSEC-2018-34
1 core/tests/testmemmap.py, 2 core/tests/testmultiarray.py, 3 f2py/f2py2e.py, and 4 lib/tests/testio.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file...
Design/Logic Flaw
1 oo-analytics-export and 2 oo-analytics-import in the openshift-origin-broker-util package in Red Hat OpenShift Enterprise 1 and 2 allow local users to have unspecified impact via a symlink attack on an unspecified file in /tmp...
PYSEC-2018-33
init.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file...
