PT-2022-9763

Name of the Vulnerable Software and Affected Versions ImpressCMS versions prior to 1.4.3 Description The issue allows directory traversal via the image temp parameter in the libraries/image-editor/image-edit.php file. This can potentially lead to unauthorized access to sensitive files on the...

CVE-2022-0315

Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0...

jersey: Local information disclosure via system temporary directory

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are...

PT-2022-12908 · Grub2 · Grub2

Name of the Vulnerable Software and Affected Versions: grub2 versions prior to 2.06-150400.7.1 grub2 versions prior to 2.06-18.1 Description: A local attacker can exploit an Insecure Temporary File vulnerability in grub-once of grub2 to truncate arbitrary files. Recommendations: For SUSE Linux...

Mozilla: Temporary files downloaded to /tmp and accessible by other local users

The Mozilla Foundation Security Advisory describes this flaw as: Previously Thunderbird for macOS and Linux would download temporary files to a user-specific directory in /tmp, but this behavior was changed to download them to /tmp where they could be affected by other local users. This behavior...

CVE-2022-22262

ROG Live Service’s function for deleting temp files created by installation has an improper link resolution before file access vulnerability. Since this function does not validate the path before deletion, an unauthenticated local attacker can create an unexpected symbolic link to system file pat...

Asus Rog Live Service 后置链接漏洞

ASUS Rog Live Service is a Desktop Shareware program from ASUS in China. A security vulnerability exists in ASUS Rog Live Service, which stems from a feature in ROG Live Service that deletes temporary files created by the installation without verifying the path before deletion, which can be...

PT-2022-11668 · Splashtop · Splashtop Remote Client

Name of the Vulnerable Software and Affected Versions: Splashtop Remote Client Personal Edition versions 3.4.6.1 and earlier Description: The issue is related to the creation of a temporary file in a directory with insecure permissions. Recommendations: For versions 3.4.6.1 and earlier, update to...

Splashtop Remote Client 安全漏洞

Splashtop Remote Client is a remote access and remote support software from Splashtop USA. A security vulnerability exists in Splashtop Remote Client Business Edition 3.4.8.3 and earlier versions that originates when Splashtop Remote Client creates temporary files in a directory with insecure...

PT-2022-2583 · Unknown +1 · Git For Windows +1

Name of the Vulnerable Software and Affected Versions: Git for Windows versions prior to 2.35.2 Description: The issue is related to a DLL hijacking vulnerability in the uninstaller of Git for Windows when run under the SYSTEM user account. This vulnerability is due to an uncontrolled search path...

GHSA-P435-W4XM-JJ8X Hadoop token in temp file visible to all users in Apache Gobblin

In Apache Gobblin, the Hadoop token is written to a temp file that is visible to all local users on Unix-like systems. This affects versions = 0.15.0. Users should update to version 0.16.0 which addresses this issue...

CVE-2021-36151

In Apache Gobblin, the Hadoop token is written to a temp file that is visible to all local users on Unix-like systems. This affects versions = 0.15.0. Users should update to version 0.16.0 which addresses this issue...

CVE-2021-36151

In Apache Gobblin, the Hadoop token is written to a temp file that is visible to all local users on Unix-like systems. This affects versions = 0.15.0. Users should update to version 0.16.0 which addresses this issue...

PT-2022-10486

Name of the Vulnerable Software and Affected Versions Apache Gobblin versions = 0.15.0 Description The issue in Apache Gobblin involves the Hadoop token being written to a temp file, making it visible to all local users on Unix-like systems. Users can update to version 0.16.0 to address this issu...

PYSEC-2022-12

IPython Interactive Python is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary...

CVE-2021-44049

CyberArk Endpoint Privilege Manager EPM through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan horse Procmon64.exe in the user's Temp directory...

CVE-2021-44049

CyberArk Endpoint Privilege Manager EPM through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan horse Procmon64.exe in the user's Temp directory...

PT-2022-11975

Name of the Vulnerable Software and Affected Versions CyberArk Endpoint Privilege Manager EPM versions prior to 11.5.3.328 Description The issue allows a local user to gain elevated privileges via a Trojan horse Procmon64.exe in the user's Temp directory. Recommendations For versions prior to...

CVE-2021-44049: Exposure of Resource to Wrong Sphere

CyberArk Endpoint Privilege Manager EPM through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan horse Procmon64.exe in the user's Temp directory...

netty: Information disclosure via the local system temporary directory

In Netty there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used, a local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the...