297 matches found
CVE-2026-59292
CVE-2026-59292...
CVE-2026-55086 Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite
Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random and place them in os.tmpdir. On a host with a shared world-writable temporary directory, a local unprivileged attacker...
CVE-2026-19474
The CVE-2026-19474 entry concerns @fastify/multipart, affecting versions 3.0.0 up to but not including 10.1.1. The root cause is that request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts; the iterato...
CVE-2026-18549 @fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit
@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts t...
CVE-2026-18549
@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts t...
PT-2026-73034
@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that...
Insecure Temporary File
Spring Boot is vulnerable to Insecure Temporary File. The vulnerability is due to the use of a predictable static directory for the embedded Artemis broker's data, which allows a local attacker to pre-create or replace the directory with a symlink and potentially redirect broker file operations t...
CVE-2026-54399 vulnerabilities
Vulnerabilities for packages: traccar-fips, geoserver, jbang, floci, dependency-track-apiserver, floci-az, cassandra-reaper, opensearch-fips, nrjmx, elasticsearch-fips, apache-hop-fips, airbyte-platform, hadoop-fips, apicurio-registry-fips, pinot-fips, elasticsearch, nuxeo, wso2is, conductor,...
ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite
Description src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts both compute their temporary working-file paths as: ts const randNum = Math.floorMath.random 0xFFFFFFFF; const srcFile = $os.tmpdir/etherpadexport$randNum.html; const destFile =...
CVE-2026-73585
A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during scri...
CVE-2026-73585
A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during scri...
CVE-2026-73584 Sblim-sfcb: sblim-sfcb: privileged file corruption and denial of service via insecure temporary file handling
A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in the /tmp directory. By repeatedly recreating a symbolic link, the attacker can redirect privileged output to an arbitrary file. Th...
CVE-2026-73585 Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack
A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during scri...
CVE-2026-73585
CVE-2026-73585 affects the sblim-cmpi-base provider registration scripts. A flaw in insecure temporary file creation enables a local unprivileged user to perform a symlink attack by placing a link in a world-writable directory, allowing privileged writes to be redirected to an arbitrary file duri...
EUVD-2026-57827
A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during scri...
CVE-2026-73585
A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during scri...
Linux Distros Unpatched Vulnerability : CVE-2026-73585
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink...
PT-2026-71460
A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during scri...
CVE-2025-59326
CVE-2025-59326 affects CPSD CryptoPro Secure Disk for Bitlocker; prior to v7.7.4, it does not enforce IMA policy protections on temporary file systems, enabling unsigned code execution from those locations. Root cause: IMA policy enforcement gap. Impact: high (per CVSS 3.1). Remediation: upgrade ...