171 matches found
PT-2024-31595 · Unknown · @Tinacms/Cli
Name of the Vulnerable Software and Affected Versions: @tinacms/cli versions prior to 1.6.2 Description: Tina is an open-source content management system CMS. Sites building with Tina CMS's command line interface CLI that use a search token may be vulnerable to the search token being leaked via...
CVE-2024-41012
In the Linux kernel, CVE-2024-41012 pertains to a fcntl/close race in file locking where an LSM could allow the first do_lock_file_wait() to acquire a lock while denying the second removal, and POSIX lock removal could fail due to GFP_KERNEL allocation during range splitting. The issue can lead t...
RHEL 4 : xorg-x11 (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - x11perfcomp has dot in its path CVE-2011-2504 - The LockServer function in os/utils.c in X.Org xserver...
GHSA-J4G3-3Q8X-JXQP dbt-core's secret env vars written to package-lock.json in plaintext
Impact When used to pull source code from a private repository using a Personal Access Token PAT, some versions of dbt-core write a URL with the PAT in plaintext to the package-lock.yml file. Patches The bug has been fixed in dbt-core v1.7.3. Mitigations Remove any git URLs with plaintext secrets...
PT-2023-33033 · Dbt-Core · Dbt-Core
Name of the Vulnerable Software and Affected Versions: dbt-core versions prior to 1.7.3 Description: The issue arises when dbt-core is used to pull source code from a private repository using a Personal Access Token PAT. In this scenario, some versions of dbt-core write a URL with the PAT in...
SMPN 1 Semarang absis security vulnerability
absis is an open source web-based K13/KTSP academic system from SMPN 1 Semarang. A security vulnerability exists in SMPN 1 Semarang absis v.2017-10-19 and earlier versions, which stems from a cross-site scripting XSS vulnerability in the user parameter of the lock/lock.php file...
Tongda OA 2017 Security Breach
Tongda2000 is a network intelligent office system from China Tongda Tongda. A security vulnerability exists in Tongda OA 2017 11.9 and earlier versions, which originates from a SQL injection vulnerability in the parameter TERMIDSTR in the file general/wiki/cp/manage/lock.php...
DEBIAN-CVE-2023-45805
pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...
UBUNTU-CVE-2023-45805
pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...
pdm security breach
pdm is a Python package management tool for the PDM project. A security vulnerability exists in versions of pdm prior to 0.11.2, which stems from the ability to craft a malicious pdm.lock file that allows an insider or malicious open source project to appear to rely on a trusted PyPI project, but...
PT-2023-24670 · Shopware · Shopware
Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 5.7.18 Description: The issue arises from an incorrect configuration in the .htaccess file, allowing the configuration file of Javascript dependencies to be read in production environments, specifically the...
SUSE CVE-2007-0472
Multiple race conditions in Smb4K before 0.8.0 allow local users to 1 modify arbitrary files via unspecified manipulations of Smb4K's lock file, which is not properly handled by the removelockfile function in core/smb4kfileio.cpp, and 2 add lines to the sudoers file via a symlink attack on...
SUSE CVE-2008-5256
The AcquireDaemonLock function in ipcdUnix.cpp in Sun Innotek VirtualBox before 2.0.6 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/.vbox-$USER-ipc/lock temporary file...
SUSE CVE-2010-0791
The 1 ncpmount, 2 ncpumount, and 3 ncplogin programs in ncpfs 2.2.6 do not properly create lock files, which allows local users to cause a denial of service application failure via unspecified vectors that trigger the creation of a /etc/mtab file that persists after the program exits...
SUSE CVE-2011-1677
mount in util-linux 2.19 and earlier does not remove the /etc/mtab lock file after a failed attempt to add a mount entry, which has unspecified impact and local attack vectors...
SUSE CVE-2011-1680
ncpmount in ncpfs 2.2.6 and earlier does not remove the /etc/mtab lock file after a failed attempt to add a mount entry, which has unspecified impact and local attack vectors...
SUSE CVE-2011-4029
The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a denial of service removed execution permission via a symlink attack on a temporary lock file...
SUSE CVE-2011-4028
The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to determine the existence of arbitrary files via a symlink attack on a temporary lock file, which is handled differently if the file exists...
SUSE CVE-2012-4455
openCryptoki 2.4.1 allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the 1 LCK..opencryptoki or 2 LCK..opencryptokistdll file in /var/lock/...