Denial Of Service (DoS)

github.com/notaryproject/notation-go is vulnerable to Denial Of Service DoS. The vulnerability is due to improper handling of temporary file operations during CRL cache updates, specifically the use of the os.Rename method, which fails when moving files across different mount points, allows an...

GHSA-2C6G-PFX3-W7H8 Insecure Temporary File in RESTEasy

Impact In RESTEasy the insecure File.createTempFile is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user. Patches Fixed in the following pull requests:...

PT-2025-1101

Name of the Vulnerable Software and Affected Versions .NET affected versions not specified Description The issue is related to a privilege elevation problem in the .NET platform, which is also associated with Microsoft Visual Studio. It involves the creation of a temporary file in a directory wit...

CVE-2024-51491 Process crash during CRL-based revocation check on OS using separate mount point for temp Directory in notation-go

notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. The issue was identified during Quarkslab's security audit on the Certificate Revocation List CRL based revocation check feature. After retrieving the CRL, notation-go...

GHSA-QJH3-4J3H-VMWP notation-go has an OS error when setting CRL cache leads to denial of signature verification

Summary The issue was identified during Quarkslab's security audit on the Certificate Revocation List CRL based revocation check feature. After retrieving the CRL, notation-go attempts to update the CRL cache using the os.Rename method. However, this operation may fail due to operating...

CVE-2023-38037

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's current umask settings, meaning that it's possible for other users on the same system to read the contents of the temporary file. Attackers that ha...

CVE-2023-38037

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's current umask settings, meaning that it's possible for other users on the same system to read the contents of the temporary file. Attackers that ha...

DEBIAN-CVE-2023-38037

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's current umask settings, meaning that it's possible for other users on the same system to read the contents of the temporary file. Attackers that ha...

UBUNTU-CVE-2023-38037

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's current umask settings, meaning that it's possible for other users on the same system to read the contents of the temporary file. Attackers that ha...

CVE-2023-38037

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's current umask settings, meaning that it's possible for other users on the same system to read the contents of the temporary file. Attackers that ha...

CVE-2023-38037

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's current umask settings, meaning that it's possible for other users on the same system to read the contents of the temporary file. Attackers that ha...

PT-2025-49806

Name of the Vulnerable Software and Affected Versions Robocode version 1.9.3.6 Description An insecure temporary file creation issue exists in the AutoExtract component. The createTempFile method does not securely create temporary files, potentially allowing attackers to exploit race conditions...

PT-2025-34184

Name of the Vulnerable Software and Affected Versions: glib2.0 affected versions not specified Description: The software contains a buffer underrun issue within the get tmp file function. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

DELL NativeEdge Information Disclosure Vulnerability

DELL NativeEdge is an edge operations software platform from Dell Technologies designed to simplify the deployment, management and secure scaling of edge computing environments. DELL NativeEdge suffers from an information disclosure vulnerability that stems from improperly set permissions on...

OESA-2024-2580 socat security update

Socat is a relay for bidirectional data transfer between two independent data channels. Each of these data channels may be a file, pipe, device serial line etc. or a pseudo terminal, a socket UNIX, IP4, IP6 - raw, UDP, TCP, an SSL socket, proxy CONNECT connection, a file descriptor stdin etc., th...

CVE-2024-52543

Dell NativeEdge, versions 2.1.0.0, contains a Creation of Temporary File With Insecure Permissions vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2024-52543

Dell NativeEdge, versions 2.1.0.0, contains a Creation of Temporary File With Insecure Permissions vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

Dell NativeEdge 安全漏洞

DELL NativeEdge is an edge operations software platform from Dell Technologies designed to simplify the deployment, management and secure scaling of edge computing environments. DELL NativeEdge suffers from an information disclosure vulnerability that stems from improperly set permissions on...

PT-2024-35368 · Dell · Dell Nativeedge

Name of the Vulnerable Software and Affected Versions: Dell NativeEdge version 2.1.0.0 Description: The issue is related to the creation of temporary files with insecure permissions. A high-privileged attacker with local access could potentially exploit this, leading to information disclosure...

Debian dla-3995 : libpostgresql-jdbc-java - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3995 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3995-1 [email protected]...