13262 matches found
PT-2023-23446 · Wondershare · Mobiletrans
Name of the Vulnerable Software and Affected Versions: MobileTrans version 4.0.11 Description: The issue is related to insecure permissions, allowing attackers to escalate privileges to local admin. This can be achieved by replacing the executable file, potentially leading to unauthorized access...
PT-2023-21861 · Unknown · Simple Design Daily Journal +1
Name of the Vulnerable Software and Affected Versions: Simple Design Daily Journal version 1.012.GP.B Description: A vulnerability has been found in the SQLite Database component, leading to cleartext storage in a file or on disk. The manipulation can be launched on the local host. The exploit ha...
Oracle Linux 8 : postgresql-jdbc (ELSA-2023-2867)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-2867 advisory. 42.2.14-2 - Fix CVE-2022-41946 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...
PT-2023-24494 · Netbox · Netbox
Name of the Vulnerable Software and Affected Versions: Netbox version 3.5.1 Description: A stored cross-site scripting XSS issue exists in the Create Provider Accounts function, specifically at the /circuits/provider-accounts/ API endpoint, allowing attackers to execute arbitrary web scripts or...
PT-2023-23007 · Cilium · Cilium
Name of the Vulnerable Software and Affected Versions: Cilium versions prior to 1.11.16 Cilium versions prior to 1.12.9 Cilium versions prior to 1.13.2 Description: This issue impacts users with a HTTP policy that applies to multiple toEndpoints and have an allow-all rule in place that affects on...
PT-2023-23129 · Apache · Apache Inlong
Name of the Vulnerable Software and Affected Versions: Apache InLong versions 1.4.0 through 1.6.0 Description: The issue is related to insufficient session expiration, allowing an old session to be used by an attacker even after the user has been deleted or the password has been changed...
CVE-2023-33251
When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: it is readable by other users on Linux or UNIX, a similar issue to CVE-2022-41946...
Lightbeed Akka Akka-http 安全漏洞
Lightbeed Akka Akka-http is a toolkit from the Lightbeed community in China. It provides a more generalized toolkit for providing and using HTTP-based services. A security vulnerability exists in Lightbeed Akka Akka-http versions prior to 10.5.2, which stems from weak permissions on temporary fil...
CVE-2023-33251
When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: it is readable by other users on Linux or UNIX, a similar issue to CVE-2022-41946...
PT-2023-16311 · Undefined · Undefined
🚨 CVE-2023-33251 When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: it is readable by other users on Linux or UNIX, a similar issue to CVE-2022-41946. 🎖@cveNotify...
Insecure Temporary File
transformers is vulnerable to Insecure Temporary Files. The vulnerability exists inside downloadurl due to the use of deprecated function tempfile.mktemp which creates temporary file names that are fundamentally insecure, as they do not ensure exclusive access to a file with the temporary name th...
PT-2023-3263 · Renderdoc · Renderdoc
Name of the Vulnerable Software and Affected Versions: RenderDoc versions prior to 1.27 Description: The issue is related to the incorrect handling of symbolic links before accessing a file in the RenderDoc library. This can allow an attacker to escalate their privileges. The vulnerability relies...
CVE-2018-1053 - Ensure that all temporary files made with "pg_upgrade" are non-world-readable
In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pgupgrade creates file in current working directory containing the output of pgdumpall -g under umask which was in effect when the user invoked pgupgrade, and not under 0077 which...
CVE-2023-2800
Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0...
CVE-2023-2800
Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0...
PYSEC-2023-299
Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0...
Design/Logic Flaw
Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0...
PYSEC-2023-299
Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0...
Jenkins: Temporary file parameter created with insecure permissions
A flaw was found in Jenkins. When triggering a build from the Jenkins CLI, Jenkins creates a temporary file on the controller if a file parameter is provided through the CLI’s standard input. Affected versions of Jenkins create this temporary file in the default temporary directory with the defau...
netty: world readable temporary file containing sensitive data
CVE-2021-21290 contains an incomplete fix, and this addresses the issue found in netty. When using multipart decoders in netty, local information disclosure can occur via the local system temporary directory if temporary storing of uploads on the disk is enabled...