Jenkins: Temporary file parameter created with insecure permissions

A flaw was found in Jenkins. When triggering a build from the Jenkins CLI, Jenkins creates a temporary file on the controller if a file parameter is provided through the CLI’s standard input. Affected versions of Jenkins create this temporary file in the default temporary directory with the defau...

Jenkins: Temporary file parameter created with insecure permissions

A flaw was found in Jenkins. When triggering a build from the Jenkins CLI, Jenkins creates a temporary file on the controller if a file parameter is provided through the CLI’s standard input. Affected versions of Jenkins create this temporary file in the default temporary directory with the defau...

guava: insecure temporary directory creation

A flaw was found in Guava. The methodology for temporary directories and files can allow other local users or apps with accordant permissions to access the temp files, possibly leading to information exposure or tampering in the files created in the directory...

guava: insecure temporary directory creation

A flaw was found in Guava. The methodology for temporary directories and files can allow other local users or apps with accordant permissions to access the temp files, possibly leading to information exposure or tampering in the files created in the directory...

PT-2024-12963 · Unknown · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite affected versions not specified Description: The issue arises from the processing of user-defined DAV user-agent strings not being limited, which could lead to a high processing load and reduce the availability of OX App Suite. T...

PT-2024-12965 · Unknown · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite affected versions not specified Description: The issue arises from the processing of user-defined mail search expressions without limitations, potentially reducing the availability of OX App Suite due to high processing load. The...

Design/Logic Flaw

nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak e.g., environment variables in instances where developers utilize MessageTemplate and incorporate user-provided data into templates. The identified...

PYSEC-2024-37

nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak e.g., environment variables in instances where developers utilize MessageTemplate and incorporate user-provided data into templates. The identified...

CVE-2024-21624 Potential Information Leak in User-Constructed Message Templates in nonebot2

nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak e.g., environment variables in instances where developers utilize MessageTemplate and incorporate user-provided data into templates. The identified...

CVE-2024-21624 Potential Information Leak in User-Constructed Message Templates in nonebot2

nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak e.g., environment variables in instances where developers utilize MessageTemplate and incorporate user-provided data into templates. The identified...

GHSA-22R3-9W55-CJ54 Pkg Local Privilege Escalation

Impact Any native code packages built by pkg are written to a hardcoded directory. On unix systems, this is /tmp/pkg/ which is a shared directory for all users on the same local system. There is no uniqueness to the package names within this directory, they are predictable. An attacker who has...

PT-2024-2767 · Envoy +1 · Envoy +1

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.26.7 Envoy versions prior to 1.27.3 Envoy versions prior to 1.28.1 Envoy versions prior to 1.29.1 Description: The issue exists due to insufficient input validation in the Envoy proxy server, allowing remote attacker...

PT-2024-20876 · Code Projects · Code-Projects Cinema Seat Reservation System

Name of the Vulnerable Software and Affected Versions: Code-projects Cinema Seat Reservation System version 1.0 Description: The issue allows SQL Injection via the id parameter at "/Cinema-Reservation/booking.php?id=1". This means an attacker could potentially inject malicious SQL code by...

PT-2024-12152 · Dell · Bsafe Ssl-J

Name of the Vulnerable Software and Affected Versions: Dell BSAFE SSL-J versions prior to 6.5 Dell BSAFE SSL-J versions 7.0 and 7.1 Description: The issue is related to a debug message revealing unnecessary information, which may lead to disclosing sensitive information to a locally privileged...

PT-2024-20594 · Node.Js +1 · Node.Js +1

Name of the Vulnerable Software and Affected Versions: pkg affected versions not specified Description: The issue arises from the pkg tool writing native code packages to a hardcoded directory, specifically /tmp/pkg/ on Unix systems, which is a shared directory for all users on the same local...

Untrusted Search Path

Overview Affected versions of this package are vulnerable to Untrusted Search Path due to the improper handling of the .be TEMP folder. An attacker can escalate privileges by monitoring the user's TEMP folder for changes and inserting a malicious DLL into the .be/.Local folder immediately when th...

CVE-2024-0985

Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The...

SUSE CVE-2024-1048

A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename operation, the temporary file will not ...

PT-2024-40202 · Microsoft · Wix

Name of the Vulnerable Software and Affected Versions: WiX installer framework affected versions not specified Description: The vulnerability allows an attacker to escalate privileges through DLL redirection attacks. When the bundle is not run as admin, the user's TEMP folder is used, and a utili...

PT-2024-40006 · Microsoft · Wix

Name of the Vulnerable Software and Affected Versions: WiX installer framework affected versions not specified Description: The vulnerability allows an attacker to escalate privileges through DLL redirection attacks. When the bundle is not run as admin, the user's TEMP folder is used, and a utili...