PT-2023-3263 · Renderdoc · Renderdoc

Name of the Vulnerable Software and Affected Versions: RenderDoc versions prior to 1.27 Description: The issue is related to the incorrect handling of symbolic links before accessing a file in the RenderDoc library. This can allow an attacker to escalate their privileges. The vulnerability relies...

CVE-2018-1053 - Ensure that all temporary files made with "pg_upgrade" are non-world-readable

In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pgupgrade creates file in current working directory containing the output of pgdumpall -g under umask which was in effect when the user invoked pgupgrade, and not under 0077 which...

CVE-2023-2800

Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0...

CVE-2023-2800

Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0...

PYSEC-2023-299

Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0...

Design/Logic Flaw

Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0...

PYSEC-2023-299

Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0...

Jenkins: Temporary file parameter created with insecure permissions

A flaw was found in Jenkins. When triggering a build from the Jenkins CLI, Jenkins creates a temporary file on the controller if a file parameter is provided through the CLI’s standard input. Affected versions of Jenkins create this temporary file in the default temporary directory with the defau...

netty: world readable temporary file containing sensitive data

CVE-2021-21290 contains an incomplete fix, and this addresses the issue found in netty. When using multipart decoders in netty, local information disclosure can occur via the local system temporary directory if temporary storing of uploads on the disk is enabled...

macOS 13.x < 13.4 Multiple Vulnerabilities (HT213758)

The remote host is running a version of macOS / Mac OS X that is 13.x prior to 13.4. It is, therefore, affected by multiple vulnerabilities: - In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user- provided environment variables SUDOEDITOR, VISUAL, and...

macOS 12.x < 12.6.6 Multiple Vulnerabilities (HT213759)

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.6.6. It is, therefore, affected by multiple vulnerabilities: - A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in watchOS 9.5, macOS Ventura 13.4, iOS 15.7.6 a...

PT-2023-23439 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version 17.0.0cu.557 Description: The issue concerns a Command Injection vulnerability. It can be exploited via the "/cgi-bin/cstecgi.cgi" API endpoint. Recommendations: For TOTOLINK A3300R version 17.0.0cu.557, as a temporary...

PT-2023-5816 · Apple · Macos Ventura +5

Name of the Vulnerable Software and Affected Versions: macOS Ventura versions prior to 13.4 tvOS versions prior to 16.5 iOS versions prior to 16.5 iPadOS versions prior to 16.5 watchOS versions prior to 9.5 Description: A privacy issue was addressed with improved handling of temporary files. This...

Hugging Face Transformers 安全漏洞

Hugging Face Transformers is advanced natural language processing for Jax, PyTorch and TensorFlow. A security vulnerability exists in Hugging Face Transformers versions prior to 4.30.0, which stems from the presence of an insecure temporary file in the program...

CVE-2023-2800

CVE-2023-2800 affects Hugging Face Transformers (prior to 4.30.0). Insecure temporary file creation via tempfile.mktemp() could enable local denial of service. The IBM/IBM Cloud Pak bulletin and GH advisories confirm the workaround: upgrade Transformers to 4.30.0 or newer.

PT-2023-20367 · Hermes +1 · Hermes +2

Name of the Vulnerable Software and Affected Versions: TypedArray versions prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 Description: A type confusion bug in TypedArray could have been used by a malicious attacker to execute arbitrary code via untrusted JavaScript. This is only...

Jenkins: Temporary file parameter created with insecure permissions

A flaw was found in Jenkins. When triggering a build from the Jenkins CLI, Jenkins creates a temporary file on the controller if a file parameter is provided through the CLI’s standard input. Affected versions of Jenkins create this temporary file in the default temporary directory with the defau...

PT-2023-22437 · Exelysis · Exelysis Unified Communication Solution

Name of the Vulnerable Software and Affected Versions: Exelysis Unified Communication Solution EUCS version 1.0 Description: A Cross Site Scripting issue allows a remote attacker to gain privileges via the URL path of the eucsAdmin login web page. Recommendations: For Exelysis Unified Communicati...

PT-2023-21290 · Weaver Oa · Weaver Oa

Name of the Vulnerable Software and Affected Versions: Weaver OA version 9.5 Description: A vulnerability was found in the processing of the file /building/backmgr/urlpage/mobileurl/configfile/jx2 config.ini, which can lead to files or directories being made accessible. The attack may be initiate...

PT-2023-23435 · Yasm +1 · Yasm +1

Name of the Vulnerable Software and Affected Versions: yasm version 1.3.0.55.g101bc Description: A segmentation violation was discovered in yasm via the function expand mmac params at /nasm/nasm-pp.c. Recommendations: For yasm version 1.3.0.55.g101bc, as a temporary workaround, consider disabling...