Weakness (CWE)
CWE-377: DEPRECATED: Insecure Temporary File
This entry has been deprecated. It was focused
only on the affected resource (temporary file) and not the
behavior or mistake that produced the insecure temporary
file, which caused confusion and incorrect
mappings.
Source: MITRE CWE-377
146 results · Feed
-
Low 2.5
pig-vector LogisticRegression.java LogisticRegression temp file
A vulnerability was found in pig-vector and classified as problematic. Affected by this issue is the function LogisticRegression of the file src/main/java/org/apache/mahout/pig/LogisticRegression.java. The manipulation leads to insecure temporary file. The at…
-
Low 3.3
Temporary File Information Disclosure Vulnerability
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or macos), MPXJ's use of `File.createTempFile(..)` results in temporary files being created with the permi…
-
Medium 4.7
TemporaryFolder on unix-like systems does not limit access to created files in pgjdbc
pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `PreparedStatemet.setBytea(int, InputStream)` will create a temporary file if the InputStream is larger th…
-
Low 2.6
OpenKM FileUtils.java getFileExtension temp file
A vulnerability was found in OpenKM up to 6.3.11 and classified as problematic. Affected by this issue is the function getFileExtension of the file src/main/java/com/openkm/util/FileUtils.java. The manipulation leads to insecure temporary file. Upgrading to v…
-
Low 2.6
ManyDesigns Portofino WarFileLauncher.java createTempDir temp file
A vulnerability has been found in ManyDesigns Portofino 5.3.2 and classified as problematic. Affected by this vulnerability is the function createTempDir of the file WarFileLauncher.java. The manipulation leads to creation of temporary file in directory with …
-
High 7.5
The deployment script in the unsupported "OpenShift Extras" set of add-on scripts, in Red Hat Openshift 1, installs a d…
-
Medium 6.5
In the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript uses a PID file that is writab…
-
Medium 6.3
ansible-runner vulnerable to Race Condition
A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible…
-
Unscored —
Filesystem race on temporary files
On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file. This issue was resolved in Velociraptor 0.6.5-2.
-
Unscored —
In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file. This may lead to…
-
Critical 9.9
A file write vulnerability exists in the httpd upload.cgi functionality of InHand Networks InRouter302 V3.5.4. A specia…
-
High 7.8CVE-2022-27772 Public exploit
Temporary Directory Hijacking to Local Privilege Escalation Vulnerability in org.springframework.boot:spring-boot
spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only…
-
Critical 9.1
Insecure Temporary File in SWHKD
SWHKD 1.1.5 unsafely uses the /tmp/swhkd.pid pathname. There can be an information leak or denial of service.
-
Medium 5.5
Data-transfer-project information disclosure via tmp directory
On unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creates files in the the system temporary directory with world readable permissions. Any sensitive information written to th…
-
High 8.2
Insecure Temporary File in horovod/horovod
Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0.
-
Medium 5.1
cscreen: usage of fixed path /tmp/cscreen.debug
A Insecure Temporary File vulnerability in cscreen of openSUSE Factory allows local attackers to cause DoS for cscreen and a system DoS for non-default systems. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.
-
Medium 5.1
grub2-once uses fixed file name in /var/tmp
A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attackers to truncate arbitrary files. This issue affects: SUSE Linux Enterprise Server 15 SP4 grub2 versions prior to 2.06-150…
-
High 8.2
Insecure Temporary File in mlflow/mlflow
Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.
-
Unscored —
caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.
-
Unscored —
golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a tempora…
-
Unscored —
In VOS and overly permissive "umask" may allow for authorized users of the server to gain unauthorized access through i…
-
High 7.3
Temporary Directory Hijacking Vulnerability in Keycloak
A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions, allowing the attacker to have access to the contents that keycloak stores in this directory. The high…
-
Medium 6.2
Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code
OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Using `File.createTempFile` in JDK will result in creating and using insecure temporary files that…
-
Critical 9.3
Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator
Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. openapi-generator-online creates insecure temporary folders with File.createT…
-
Medium 4.0
Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin
OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using `File.createTempFile` in JDK will result in creating and using insecure temporary files that can leave applic…
-
Low 3.3
Local DoS of VM live migration due to use of static tmp files in detach_disks.sh in s390-tools
A Insecure Temporary File vulnerability in s390-tools of SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-SP2 allows local attackers to prevent VM live migrations This issue affects: SUSE Linux Enterprise Server 12-SP5 s390-tools versions …
-
Medium 4.0
Information disclosure through temporary directory permissions
In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local information disclosure. Remote files accessed thro…
-
Medium 4.4
Insecure temporary file in Netflix OSS Hollow
In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be…
-
Medium 6.2
Netflix/Priam: Temporary Directory Information Disclosure
Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--. An attacker with read access to the local filesystem can read anything written there by the Priam process.
-
Unscored —
Oozie local privilege escalation
There is a race condition in OozieSharelibCLI in Apache Oozie before version 5.2.1 which allows a malicious attacker to replace the files in Oozie's sharelib during it's creation.
-
Medium 6.7
Local privilege escalation to root due to insecure tmp file usage
A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows local attackers to escalate to root. This issue affects: openSUSE Factory cyrus-sasl version 2.1.27-4.2 and prior versions.
-
High 7.3
openldap uses fixed paths in /tmp
A Insecure Temporary File vulnerability in openldap2 of SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to overwrite arbitrary files and gain access to the openldap2 …
-
Low 3.6
skuba: Insecure /tmp usage when joining node to cluster
A Insecure Temporary File vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to leak the bootstrapToken or modify the configuration file before it is processed, leading to arbitrary modifications of the machine/cluster.
-
Medium 4.4
Insecure Temporary File
This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between user…
-
Medium 6.6
A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file …
-
Medium 5.0
Exposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. …
-
High 7.0
PAN-OS: Temporary file race condition vulnerability in PAN-OS leads to local privilege escalation
A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation from a limited linux user account. This allows an attacker who has escaped the restricted shell as a low privilege admini…
-
Medium 4.1
PAN-OS: Predictable temporary file vulnerability
A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell access to corrupt arbitrary system files affecting the integrity of the system. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earli…
-
Medium 5.0
Exposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible
A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault fi…
-
High 7.8
Traps: Insecure temporary file vulnerability may allow privilege escalation on Windows
An insecure temporary file vulnerability in Palo Alto Networks Traps allows a local authenticated Windows user to escalate privileges or overwrite system files. This issue affects Palo Alto Networks Traps 5.0 versions before 5.0.8; 6.1 versions before 6.1.4 o…