CVE-2022-35631

Filesystem race on temporary files

On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file. This issue was resolved in Velociraptor 0.6.5-2.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Linux Rapid7

Products

Macos Linux Kernel Velociraptor

CVE-2022-21945

cscreen: usage of fixed path /tmp/cscreen.debug

A Insecure Temporary File vulnerability in cscreen of openSUSE Factory allows local attackers to cause DoS for cscreen and a system DoS for non-default systems. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Opensuse

Products

Cscreen Factory

CVE-2022-0736

Insecure Temporary File in mlflow/mlflow

Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed

Vendors

Lfprojects

Products

Mlflow

CVE-2022-0315

Insecure Temporary File in horovod/horovod

Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Horovod

Products

Horovod

CVE-2021-46705

grub2-once uses fixed file name in /var/tmp

A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attackers to truncate arbitrary files. This issue affects: SUSE Linux Enterprise Server 15 SP4 grub2 versions prior to 2.06-150400.7.1. SUSE openSUSE Factory grub2 versions prior to 2.06-18.1.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu Opensuse Suse

Products

Grub2 Factory Linux Enterprise Server

CVE-2021-25316

Local DoS of VM live migration due to use of static tmp files in detach_disks.sh in s390-tools

A Insecure Temporary File vulnerability in s390-tools of SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-SP2 allows local attackers to prevent VM live migrations This issue affects: SUSE Linux Enterprise Server 12-SP5 s390-tools versions prior to 2.1.0-18.29.1. SUSE Linux Enterprise Server 15-SP2 s390-tools versions prior to 2.11.0-9.20.1.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Suse

Products

Linux Enterprise Server S390-tools

CVE-2021-20202

keycloak: Temporary Directory Hijacking Vulnerability in Keycloak

A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions, allowing the attacker to have access to the contents that keycloak stores in this directory. The highest threat from this vulnerability is to data confidentiality and integrity.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Keycloak

CVE-2020-8032

Local privilege escalation to root due to insecure tmp file usage

A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows local attackers to escalate to root. This issue affects: openSUSE Factory cyrus-sasl version 2.1.27-4.2 and prior versions.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Opensuse

Products

Cyrus-sasl

CVE-2020-8030

skuba: Insecure /tmp usage when joining node to cluster

A Insecure Temporary File vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to leak the bootstrapToken or modify the configuration file before it is processed, leading to arbitrary modifications of the machine/cluster.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Suse

Products

Caas Platform

CVE-2020-8027

openldap uses fixed paths in /tmp

A Insecure Temporary File vulnerability in openldap2 of SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to overwrite arbitrary files and gain access to the openldap2 configuration This issue affects: SUSE Linux Enterprise Server 15-LTSS openldap2 versions prior to 2.4.46-9.37.1. SUSE Linux Enterprise Server for SAP 15 openldap2 versions prior to 2.4.46-9.37.1. openSUSE Leap 15.1 openldap2 versions prior to 2.4.46-lp151.10.18.1. openSUSE Leap 15.2 openldap2 versions prior to 2.4.46-lp152.14.9.1.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Opensuse Suse

Products

Leap Openldap2 Linux Enterprise Server

CVE-2020-2016

PAN-OS: Temporary file race condition vulnerability in PAN-OS leads to local privilege escalation

A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation from a limited linux user account. This allows an attacker who has escaped the restricted shell as a low privilege administrator, possibly by exploiting another vulnerability, to escalate privileges to become root user. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; All versions of PAN-OS 8.0.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Pan-os

CVE-2020-27216

jetty: local temporary directory hijacking vulnerability

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.

CVSS 3.1 · 7.0 High EPSS 4.4% KEV · Not listed

Vendors

Apache Debian Eclipse and 4 more

Products

Beam Debian Linux Jetty and 21 more

CVE-2020-25636

Collections: aws_ssm connection plugin should namespace its file transfers

A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are written directly to the root bucket, making possible to have collisions when running multiple ansible processes. This issue affects mainly the service availability.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible

CVE-2020-1994

PAN-OS: Predictable temporary file vulnerability

A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell access to corrupt arbitrary system files affecting the integrity of the system. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.7.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Pan-os

CVE-2020-1991

Traps: Insecure temporary file vulnerability may allow privilege escalation on Windows

An insecure temporary file vulnerability in Palo Alto Networks Traps allows a local authenticated Windows user to escalate privileges or overwrite system files. This issue affects Palo Alto Networks Traps 5.0 versions before 5.0.8; 6.1 versions before 6.1.4 on Windows. This issue does not affect Cortex XDR 7.0. This issue does not affect Traps for Linux or MacOS.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft Paloaltonetworks

Products

Windows Traps

CVE-2020-1981

PAN-OS: Predictable temporary filename vulnerability allows local privilege escalation

A predictable temporary filename vulnerability in PAN-OS allows local privilege escalation. This issue allows a local attacker who bypassed the restricted shell to execute commands as a low privileged user and gain root access on the PAN-OS hardware or virtual appliance. This issue affects only PAN-OS 8.1 versions earlier than PAN-OS 8.1.13. This issue does not affect PAN-OS 7.1, PAN-OS 9.0, or later PAN-OS versions.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Pan-os

CVE-2020-1945

ant: insecure temporary file vulnerability

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.

CVSS 3.1 · 6.3 Medium EPSS 1.8% KEV · Not listed

Vendors

Apache Canonical Fedoraproject and 3 more

Products

Ant Ubuntu Linux Fedora and 51 more

CVE-2020-1740

ansible: secrets readable after ansible-vault edit

A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat

Products

Debian Linux Fedora Ansible and 4 more

CVE-2020-1733

ansible: insecure temporary directory when running become_user from become directive

A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat

Products

Debian Linux Fedora Ansible and 4 more

CVE-2020-10744

ansible: incomplete fix for CVE-2020-1733

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Ansible Tower