RUSTSEC-2018-0017 `tempdir` crate has been deprecated; use `tempfile` instead

The tempdir crate has been deprecated and the functionality is merged into tempfile...

Ruby: Unintentional file creation caused at Tempfile with directory traversal

The Tempfile argument of basename can use ../ without escaping. Therefore, directory traversal may occur and unintended files may be generated. create file patern log vagrant@localhost $ ls . vagrant@localhost $ irb irbmain:001:0 require 'tempfile' = true irbmain:002:0...

CVE-2017-8933

Libmenu-cache 1.0.2 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service menu unavailability...

Insecure Tempfile Usage

ansible is vulnerable to insecure tempfile usage. The library creates temporary file names based on the system time. This can allow a malicious user to guess the temporary file name based on the system time, leading to sensitive information being disclosed...

Ruby on Rails Dynamic Render File Upload Remote Code Execution

This module exploits a remote code execution vulnerability in the explicit render method when leveraging user parameters. This module has been tested across multiple versions of Ruby on Rails. The technique used by this module requires the specified endpoint to be using dynamic render paths, such...

Ruby on Rails Dynamic Render File Upload Remote Code Execution

This Metasploit module exploits a remote code execution vulnerability in the explicit render method when leveraging user parameters. This Metasploit module has been tested across multiple versions of Ruby on Rails. The technique used by this module requires the specified endpoint to be using...

CVE-2013-4472

The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names...

DEBIAN-CVE-2014-1839

The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file...

PYSEC-2014-84

The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file...

Code injection

The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file...

PT-2014-4323 · Logilab +1 · Logilab-Common +1

Name of the Vulnerable Software and Affected Versions: logilab-common versions prior to 0.61.0 Description: The Execute class in shellutils in logilab-common uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file. Recommendations: For...

DEBIAN-CVE-2014-1640

axiom-test.sh in axiom 20100701-1.1 uses tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename...

CVE-2014-1638

1 debian/postrm and 2 debian/localepurge.config in localepurge before 0.7.3.2 use tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename...

CVE-2014-1638

1 debian/postrm and 2 debian/localepurge.config in localepurge before 0.7.3.2 use tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename...

CVE-2014-1638

1 debian/postrm and 2 debian/localepurge.config in localepurge before 0.7.3.2 use tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename...

Code injection

axiom-test.sh in axiom 20100701-1.1 uses tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename...

CVE-2014-1640

axiom-test.sh in axiom 20100701-1.1 uses tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename...

CVE-2014-1640

CVE-2014-1640 affects the axiom package (version 20100701-1.1). The vulnerability arises from axiom-test.sh using tempfile to create a temporary file, but then appending a suffix to the original filename and writing to that new filename. This behavior permits local users to overwrite arbitrary fi...

CVE-2014-1640

axiom-test.sh in axiom 20100701-1.1 uses tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename...

Fedora 17 : python-virtualenvwrapper-3.2-3.fc17 (2012-7476)

Patches security vulernability around tempfile trap. Enhancements to virtualenv Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...