CVE-2022-0315 Insecure Temporary File in horovod/horovod

Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0...

CVE-2022-0315

The CVE-2022-0315 issue affects horovod/horovod prior to 0.24.0, where insecure use of tempfile.mktemp() can occur when Horovod runs in an LSF job with jsrun. This could allow a separate process to read or modify the created rank file. The advisory notes that the problem is fixed in commit b96eca...

GitHub horovod 安全漏洞

GitHub horovod is a distributed training framework for TensorFlow, Keras, PyTorch, and Apache MXNet. A security vulnerability exists in GitHub horovod 0.24.0, which stems from a previously insecure temporary file...

USN-5345-1 thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass security restrictions, obtain sensitive information, cause undefined...

guava: local information disclosure via temporary directory created with unsafe permissions

A flaw was found in Guava that creates temporary directories with default permissions similar to /tmp. This issue may allow local users access, possibly permitting information exposure...

jersey: Local information disclosure via system temporary directory

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are...

PT-2022-16865 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 0.5.0 through 2.3.1 Argo CD versions 2.0.x and earlier Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper...

The vulnerability of the Adobe Creative Cloud Desktop Application, related to the creation of temporary files with insecure permissions, allows a malicious actor to obtain root privileges and re-record any file.

The vulnerability of the Adobe Creative Cloud Desktop Application relates to the creation of temporary files with insecure permissions. Exploiting this vulnerability can allow an attacker to obtain root privileges and re-record any file...

The vulnerability of the Adobe Genuine Service application checking service lies in the creation of temporary files with insecure permissions, allowing a violator to increase their privileges.

The vulnerability of the Adobe Genuine Service application checking service is related to the creation of temporary files with insecure permissions. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

CVE-2022-25518

In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of the users who login to the application by querying the database table...

CVE-2022-25518

In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of the users who login to the application by querying the database table...

guava: local information disclosure via temporary directory created with unsafe permissions

A flaw was found in Guava that creates temporary directories with default permissions similar to /tmp. This issue may allow local users access, possibly permitting information exposure...

jersey: Local information disclosure via system temporary directory

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are...

Privilege Escalation

org.keycloak:keycloak-services is vulnerable to privilege escalation. A local attacker is able to create directories prior to the Java process creating them in the temporary directory with wider user permissions resulting in attackers having access to the contents that keycloak stores in this...

SUSE SLED15 / SLES15 Security Update : MozillaThunderbird (SUSE-SU-2022:0906-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0906-1 advisory. - An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a...

Ninja Forms < 3.6.8 - Unauthenticated Email Address Disclosure

The plugin does not delete the temporary files created when exporting submissions, which could allow unauthenticated attackers to download them and get sensitive information such as the email address of users who submitted a form given that the file is publicly accessible, and with a guessable na...

PT-2022-2037 · Fedoraproject +2 · Extra Packages For Enterprise Linux +3

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified fedoraproject extra packages for enterprise linux affected versions not specified fedoraproject fedora affected versions not specified Description: The issue is related to a lack of protection against SQ...

PT-2022-13166 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: gogs versions prior to 0.12.6 Description: The issue allows a malicious user to upload a crafted config file into a repository's .git directory to gain SSH access to the server. This affects all installations with repository upload enabled,...

Temporary Directory Hijacking Vulnerability in Keycloak

A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions, allowing the attacker to have access to the contents that keycloak stores in this directory. The highest threat from this vulnerability is ...

Google SA360 WebQuery to BigQuery Exporter安全漏洞

Google SA360 WebQuery to BigQuery Exporter is an open source tool for importing Search Ads 360 Webquery reports into BigQuery from Google, Inc. A security vulnerability exists in versions prior to Google SA360 WebQuery to BigQuery Exporter 1.0.3, which originates from a local attacker being able ...