14693 matches found
CVE-2025-71176
pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-user name pattern, which allows local users to cause a denial of service or possibly gain privileges...
CVE-2025-71176
pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-user name pattern, which allows local users to cause a denial of service or possibly gain privileges...
CVE-2025-71176
pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-user name pattern, which allows local users to cause a denial of service or possibly gain privileges...
PT-2026-4296
Name of the Vulnerable Software and Affected Versions Rufus versions 4.11 and below Description Rufus, a utility for formatting and creating bootable USB flash drives, contains a time-of-check to time-of-use TOCTOU race condition in the src/net.c file. This occurs during the creation, validation,...
CVE-2025-71176: Creation of Temporary File in Directory with Insecure Permissions
pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-user name pattern, which allows local users to cause a denial of service or possibly gain privileges...
Azure Linux 3.0 Security Update: junit (CVE-2020-15250)
The version of junit installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-15250 advisory. - In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information...
PT-2026-3918
Name of the Vulnerable Software and Affected Versions pytest versions through 9.0.2 Description The software on UNIX systems creates directories using a predictable naming pattern, specifically '/tmp/pytest-of-user'. This design flaw allows local users to potentially disrupt service or escalate...
Pytest security vulnerabilities
Pytest is a testing framework based on the Python language, developed by the Pytest team. Pytest versions 9.0.2 and earlier have security vulnerabilities. These vulnerabilities stem from reliance on directories with the /tmp/pytest-of-user naming pattern, which could allow local users to launch...
CVE-2026-23516
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0, an attacker is able to execute arbitrary JavaScript in a victim user's CVAT UI session, provided that they are able to create a maliciously crafted label in a CVAT task or...
CVE-2026-23516
CVAT (open-source annotation tool) is affected in versions 2.2.0–2.54.0 by an XSS-like vulnerability that lets an attacker execute arbitrary JavaScript in a victim user’s CVAT UI session. The attack requires the attacker to create a malicious label or an SVG in a skeleton configuration and coerce...
CVE-2026-23516 CVAT vulnerable to XSS via skeleton SVG images
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0, an attacker is able to execute arbitrary JavaScript in a victim user's CVAT UI session, provided that they are able to create a maliciously crafted label in a CVAT task or...
CVE-2021-47871
Hestia Control Panel 1.3.2 contains an arbitrary file write vulnerability that allows authenticated attackers to write files to arbitrary locations using the API index.php endpoint. Attackers can exploit the v-make-tmp-file command to write SSH keys or other content to specific file paths on the...
CVE-2021-47871
CVE-2021-47871 affects Hestia Control Panel 1.3.2. An authenticated attacker can exploit the API endpoint index.php via the v-make-tmp-file command to perform arbitrary file writes, potentially placing SSH keys or other content at arbitrary server paths. Impact is high for confidentiality, integr...
EUVD-2026-3620
Hestia Control Panel 1.3.2 contains an arbitrary file write vulnerability that allows authenticated attackers to write files to arbitrary locations using the API index.php endpoint. Attackers can exploit the v-make-tmp-file command to write SSH keys or other content to specific file paths on the...
MiracleLinux 7 : libqb-1.0.1-9.el7 (AXSA:2020-4550:01)
The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-4550:01 advisory. libqb: Insecure treatment of IPC temporary files CVE-2019-12779 Tenable has extracted the preceding description block directly from the MiracleLinux security...
MiracleLinux 8 : postgresql-jdbc-42.2.14-2.el8 (AXSA:2023-5995:03)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-5995:03 advisory. postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions CVE-2022-41946 Tenable has extracted the preceding...
MiracleLinux 9 : postgresql-jdbc-42.2.27-1.el9 (AXSA:2023-5766:02)
The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2023-5766:02 advisory. postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions CVE-2022-41946 Tenable has extracted the preceding...
MiracleLinux 4 : selinux-policy-3.7.19-54.AXS4.5, policycoreutils-2.0.83-19.8.AXS4 (AXSA:2011-152:01)
The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2011-152:01 advisory. Security-enhanced Linux is a feature of the Linux kernel and a number of utilities with enhanced security functionality designed to add mandatory access...
MiracleLinux 7 : policycoreutils-2.5-22.el7 (AXSA:2018-2922:01)
The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-2922:01 advisory. policycoreutils: Relabelling of symbolic links in /tmp and /var/tmp change the context of their target instead CVE-2018-1063 Tenable has extracted the...