PT-2024-20530 · Bref · Bref

Name of the Vulnerable Software and Affected Versions: Bref versions prior to 2.1.13 Description: The issue arises when Bref is used with the Event-Driven Function runtime and the handler is a RequestHandlerInterface. In this scenario, the Lambda event is converted to a PSR7 object. During the...

Mageia: Security Advisory (MGASA-2024-0013)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated hplip packages fix security vulnerabilities

There were security issues in hplip's hpps program due to fixed /tmp path usage in prnt/hpps/hppsfilter.c This update fixes these issues...

MGASA-2024-0013 Updated hplip packages fix security vulnerabilities

There were security issues in hplip's hpps program due to fixed /tmp path usage in prnt/hpps/hppsfilter.c This update fixes these issues...

CVE-2023-6114: Files or Directories Accessible to External Parties

The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the backups-dup-lite/tmp directory or the backups-dup-pro/tmp directory in the Pro version, which temporarily stores files containing sensitive data. When directory listing is...

CentOS 7 : insights-client (RHSA-2023:6795)

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6795 advisory. - A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and...

The vulnerability of the account_print.cgi component in the microprogramming software for Zyxel USG FLEX and VPN devices allows a hacker to execute arbitrary commands.

The vulnerability of the accountprint.cgi component in the Zyxel USG FLEX and VPN network devices is related to an incorrect limitation on the path name to the tmp directory. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the Insights-Client client API’s interface, related to the creation of temporary files with insecure permissions, allows a hacker to escalate their privileges.

The vulnerability of the Insights-Client client API’s interface is related to the creation of temporary files with insecure permissions in the /var/tmp/insights-client directory. Exploiting this vulnerability could allow an attacker to increase their privileges...

mariadb: server crash in create_tmp_table::finalize

A flaw was found in MariaDB. The component, Createtmptable::finalize, allows attackers to cause a denial of service DoS via specially crafted SQL statements, affecting availability...

insights-client: unsafe handling of temporary files and directories

A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local...

insights-client: unsafe handling of temporary files and directories

A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local...

insights-client: unsafe handling of temporary files and directories

A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local...

insights-client: unsafe handling of temporary files and directories

A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local...

insights-client: unsafe handling of temporary files and directories

A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local...

insights-client: unsafe handling of temporary files and directories

A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local...

CVE-2023-3972: Creation of Temporary File in Directory with Insecure Permissions

A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local...

SUSE CVE-2015-5273

The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool ABRT before 2.7.1 allows local users to write to arbitrary files via a symlink attack on unpacked.cpio in a pre-created directory with a predictable name in /var/tmp...

SUSE CVE-2018-14650

It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any local user. A local attacker may use this flaw by waiting for a legit user to run sos-collector and steal the collected data in the...

Arbitrary File Upload

Gradio is vulnerable to an Arbitrary File Upload vulnerability. The vulnerability is due to the /upload interface endpoint via /tmp directory. The attacker can exploit this by uploading arbitrary files, potentially leading to unauthorized access or execution of malicious code...

CVE-2023-43783

Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/cadence-wineasio.reg Temporary File. The filename is used even if it has been created by a local adversary before Cadence started. The adversary can leverage this to create or overwrite files via a symlink attack. In some kernel configuration...