13232 matches found
CVE-2020-29582
CVE-2020-29582 : In JetBrains Kotlin prior to 1.4.21, a vulnerable Java API was used for temporary file and folder creation, enabling an attacker to read data from those files and list directories due to insecure permissions. Affected product: Kotlin/JetBrains Kotlin (pre-1.4.21). Root cause: ins...
CVE-2020-29582
In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions...
Insecure Temporary File
Overview com.squareup:connect is a stack of middleware that is executed in order in each request. Affected versions of this package are vulnerable to Insecure Temporary File. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like system...
jetty: local temporary directory hijacking vulnerability
In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub...
PT-2021-14414 · Uap-Core · Uap-Core
Name of the Vulnerable Software and Affected Versions: uap-core versions prior to 0.11.0 Description: The issue concerns regular expression denial of service REDoS due to overlapping capture groups in some regexes. This allows remote attackers to overload a server by setting the User-Agent header...
PT-2021-9036 · Tk Star · Tk-Star Q90 Junior Gps
Name of the Vulnerable Software and Affected Versions: TK-Star Q90 Junior GPS horloge version 3.1042.9.8656 Description: An issue was discovered where any SIM card used with the device cannot have a PIN configured. If a PIN is configured, the device produces a "Remove PIN and restart!" message an...
CVE-2020-17521
A flaw was found in Apache Groovy. Groovy makes use of a method for creating temporary directories which is not suitable for security-sensitive contexts and allows for sensitive information leakage. The highest threat from this vulnerability is to data confidentiality. Mitigation Setting the...
The vulnerability in the implementation of the fetch() function for obtaining resources from the Fetch API interface of Mozilla Firefox and Firefox-ESR browsers allows a perpetrator to gain unauthorized access to protected information.
The vulnerability in the implementation of the fetch function for obtaining resources through the Fetch API on Mozilla Firefox and Firefox-ESR browsers is related to an error in returning temporary local copies of resources. These resources were sent with a cache header indicating “no caching”...
Security Bulletin: Apache Ant as used by IBM QRadar SIEM is vulnerable to Insecure Temporary Files (CVE-2020-11979)
Summary Apache Ant as used by IBM QRadar SIEM is vulnerable to Insecure Temporary Files Vulnerability Details CVEID: CVE-2020-11979 DESCRIPTION: Apache Ant could allow a remote authenticated attacker to bypass security restrictions, caused by an insecure temporary file flaw. By sending a...
openSUSE Security Update : PackageKit (openSUSE-2020-2292)
This update for PackageKit fixes the following issue : - CVE-2020-16121: Fixed an Information disclosure in InstallFiles, GetFilesLocal and GetDetailsLocal bsc1176930. - Notify service manager when it shutdown and cleanup temporary files when PackageKit quits. bsc1169739 This update was imported...
PT-2021-13843 · Privoxy +3 · Privoxy +3
Name of the Vulnerable Software and Affected Versions: Privoxy versions prior to 3.0.29 Description: A flaw in Privoxy causes a memory leak when multiple filters are executed and the last one is skipped due to a pcre error, leading to a system crash. This issue allows attackers to cause the syste...
Unauthenticated information leakage of temporary files and project keys - CVE-2021-26069
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate project keys via an Information Disclosure vulnerability in the /rest/api/1.0/issues/\id/ActionsAndOperations API endpoint. The affected versions are before...
postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution
A flaw was discovered in postgresql where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function...
postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution
A flaw was discovered in postgresql where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function...
CVE-2020-7343
Missing Authorization vulnerability in McAfee Agent MA for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files...
CVE-2020-7343
Missing Authorization vulnerability in McAfee Agent MA for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files...
CVE-2020-7343 Improper Authorization vulnerability in MA
Missing Authorization vulnerability in McAfee Agent MA for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files...
PT-2021-12647 · Mcafee · Mcafee Agent
Name of the Vulnerable Software and Affected Versions: McAfee Agent MA for Windows versions prior to 5.7.1 Description: The issue allows local users to block product updates by manipulating a directory used for temporary files, resulting in the product continuing to function with out-of-date...
Heap overflow
On Juniper Networks MX Series and EX9200 Series platforms with Trio-based MPC Modular Port Concentrator where Integrated Routing and Bridging IRB interface is configured and it is mapped to a VPLS instance or a Bridge-Domain, certain network events at Customer Edge CE device may cause memory leak...