Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2014-1624

pyxdg: TOCTOU race condition in get_runtime_dir() when strict=False

Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Python
Products
Pyxdg
CVE-2019-12761

pyxdg: code injection via crafted python code

A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.

CVSS 3.0 · 7.5 High EPSS 2.1% KEV · Not listed
Vendors
Python
Products
Pyxdg