13869 matches found
CVE-2017-0367
Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure...
CVE-2017-0367
Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure...
Directory traversal
Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure...
CVE-2017-0367 Having LocalisationCache directory default to system tmp directory is insecure
Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure...
CVE-2017-0367
MediaWiki before 1.28.1 / 1.27.2 is affected by an insecure use of a temporary directory for LocalisationCache, causing insecure handling when the directory defaults to the system temp directory. Root cause: unsafe temporary-directory usage. Impact (as stated/implied): partial confidentiality, in...
CVE-2017-0367: Exposure of Resource to Wrong Sphere
Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure...
ExpressionEngine: RCE By import channel field
The reporter determined that a malicious Channel Set could be used to allow an administrator to upload a PHP file that they might otherwise not have permission to upload. Combined with the temporary folder name algorithm being available in the source code, the malicious administrator could...
policycoreutils: Relabelling of symbolic links in /tmp and /var/tmp change the context of their target instead
Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state...
Thycotic Secret Server Credentials Disclosure Vulnerability
The Remote Desktop Launcher in Thycotic Secret Server does not properly cleanup a temporary file that contains an encrypted password once a session has ended. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...
Directory Traversal
rubysl-tmpdir is vulnerable to directory traversal attacks.The Dir.mktmpdir method accepts a prefix which could contain a string such as ../ which would allow an attacker to create temporary directories anywhere within the server if the prefix method can be attacker controlled...
CVE-2018-5731
An issue was discovered in Heimdal PRO 2.2.190. As part of the scanning feature, a process called md.hs writes an executable called CS1.tmp to C:\windows\TEMP. Afterwards the executable is run. It is possible for an attacker to create the file first, let md.hs overwrite it, and then rewrite the...
CVE-2018-3710
Gitlab Community and Enterprise Editions version 10.3.3 is vulnerable to an Insecure Temporary File in the project import component resulting remote code execution...
CVE-2018-3710
Gitlab Community and Enterprise Editions version 10.3.3 is vulnerable to an Insecure Temporary File in the project import component resulting remote code execution...
CVE-2018-3710
Gitlab Community and Enterprise Editions version 10.3.3 is vulnerable to an Insecure Temporary File in the project import component resulting remote code execution...
CVE-2018-3710
CVE-2018-3710 affects GitLab Community/Enterprise Edition 10.3.3, with an insecure temporary file in the project import component enabling remote code execution. Multiple sources (NVD, Debian DSA, CNVD, OSV) corroborate an arbitrary code execution via project import; CVE-2018-3710 is part of a se...
CVE-2018-3710
Removed by vendor...
PT-2018-5649 · Sdl +2 · Sdl2 Image +2
Name of the Vulnerable Software and Affected Versions: SDL2 image version 2.0.2 Description: A code execution issue exists in the XCF image rendering functionality. A specially crafted XCF image can cause a heap overflow, resulting in code execution. An attacker can trigger this issue by displayi...
PT-2018-16134 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: Gitlab Community and Enterprise Editions version 10.3.3 Description: The issue is related to an insecure temporary file in the project import component, which can result in remote code execution. Recommendations: For Gitlab Community and...
Thycotic Secret Server Remote Desktop Launcher Remote Desktop Launch Vulnerability
Thycotic Secret Server is a suite of password protection software from Thycotic, Inc. Remote Desktop Launcher is one of the remote desktop launchers. A security vulnerability exists in Remote Desktop Launcher in versions of Thycotic Secret Server prior to 8.6.000010, which stems from the program...