Advisories · Weakness
CWE-377.
Every Advisory and CVE whose sources give the weakness CWE-377, newest first.
- CVSS 2.0 Low
chidiwilliams buzz model_loader.py download_model temp file
- chidiwilliams buzz
- CWE-377
- CVSS 6.8 Medium
Denial of Service vulnerability in ESET products for macOS
- ESET, spol. s r.o. ESET Cyber Security
- ESET, spol. s r.o. ESET Endpoint Security for macOS
- CWE-377
- CVSS 8.5 High
Point B Ltd Getscreen Agent MSI Installer getscreen.msi temp file
- Point B Ltd Getscreen Agent
- CWE-377
- CWE-378
- CVSS 5.1 Medium
In Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp.
- CWE-377
- CVSS 2.8 Low
Insecure temporary file in bpftrace
- bpftrace
- CWE-377
- CVSS 6.5 Medium
Insecure temporary file in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- CWE-377
- CVSS 3.3 Low
Spring Cloud Contract vulnerable to local information disclosure
- Broken access control
- CWE-377
>=4.1.0, <4.1.1 || >=4.0.0, <4.0.5 || >=3.1.0, <3.1.10 · fixed in 4.1.1, 4.0.5, 3.1.10
GHSA-p6rp-mx85-m459 · CVE-2024-22236 - CVSS 6.0 Medium
Resource exposure in Ubuntu Budgie Budgie Extras
- Ubuntu Budgie Budgie Extras
- Information disclosure
- CWE-377
- CVSS 6.0 Medium
Insecure temporary file in Ubuntu Budgie Budgie Extras
- Ubuntu Budgie Budgie Extras
- Information disclosure
- CWE-377
- CVSS 6.0 Medium
Resource exposure in Ubuntu Budgie Budgie Extras
- Ubuntu Budgie Budgie Extras
- Information disclosure
- CWE-377
- CVSS 6.0 Medium
Insecure temporary file in Ubuntu Budgie Budgie Extras
- Ubuntu Budgie Budgie Extras
- Information disclosure
- CWE-377
- CVSS 6.0 Medium
Insecure temporary file in Ubuntu Budgie Budgie Extras
- Ubuntu Budgie Budgie Extras
- Information disclosure
- CWE-377
- CVSS 3.6 Low
Jenkins temporary uploaded file created with insecure permissions
- CWE-377
>=2.50, <2.414.2 || >=2.415, <2.424 · fixed in 2.414.2, 2.424
GHSA-hq87-h4jg-vxfw · CVE-2023-43498 - CVSS 5.5 Medium
Active Support Possibly Discloses Locally Encrypted Files
- Broken access control
- CWE-377
>=5.2.0, <6.1.7.5 || >=7.0.0, <7.0.7.1 · fixed in 6.1.7.5, 7.0.7.1
GHSA-cr5q-6q9f-rq6q · CVE-2023-38037 - CVSS 7.1 High
Insecure Temporary File in HuTool
- Broken access control
- CWE-377
<5.8.19 · fixed in 5.8.19
GHSA-7mcw-xmx3-7p8m · CVE-2023-33695 - CVSS 4.7 Medium
Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0.
- CWE-377
<4.30.0 · fixed in 4.30.0
GHSA-282v-666c-3fvg · CVE-2023-2800 - CVSS 6.4 Medium
Insecure temporary file in Dell SupportAssist
- Dell SupportAssist
- CWE-377
- CVSS 5.5 Medium
Java Merge-sort Insecure Temporary File vulnerability
- Information disclosure
- CWE-377
<1.1.0 · fixed in 1.1.0
GHSA-qxxc-7mq4-mf79 · CVE-2022-24913 - CVSS 6.3 Medium
globalpom-utils has Insecure Temporary File
- Information disclosure
- CWE-377
<4.5.1 · fixed in 4.5.1
GHSA-jjvp-wfp8-rv69 · CVE-2018-25068 - CVSS 3.1 Low
centic9 jgit-cookbook temp file
- centic9 jgit-cookbook
- CWE-377
- CVSS 6.5 Medium
Insecure temporary file in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- CWE-377
- CVSS 2.5 Low
pig-vector LogisticRegression.java LogisticRegression temp file
- pig-vector
- CWE-377
- CVSS 3.3 Low
Temporary File Information Disclosure vulnerability in MPXJ
- Information disclosure
- CWE-377
<10.14.1 · fixed in 10.14.1
GHSA-jf2p-4gqj-849g · CVE-2022-41954 - CVSS 4.7 Medium
TemporaryFolder on unix-like systems does not limit access to created files
- Information disclosure
- CWE-377
>=42.2.0, <42.2.27 || >=42.3.0, <42.3.8 || >=42.4.0, <42.4.3 || >=42.5.0, <42.5.1 · fixed in 42.2.27, 42.3.8, 42.4.3, 42.5.1
GHSA-562r-vg33-8x8h · CVE-2022-41946 - CVSS 2.6 Low
OpenKM FileUtils.java getFileExtension temp file
- OpenKM
- CWE-377
- CVSS 2.6 Low
ManyDesigns Portofino subject to creation of insecure temporary file
- Information disclosure
- CWE-377
<5.3.3 · fixed in 5.3.3
GHSA-925r-r6rp-2jj7 · CVE-2022-3952 - CVSS 7.5 High
Insecure temporary file in Red Hat Openshift
- Red Hat Openshift
- CWE-377
- CVSS 6.5 Medium
In the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript uses a PID file that is writable by the smokeping user.
- CWE-377
- CVSS 6.3 Medium
ansible-runner vulnerable to Race Condition
- Race condition
- CWE-377
>=2.0.0, <2.1.0 · fixed in 2.1.0
GHSA-772j-xvf9-qpf5 · CVE-2021-3702 -
Filesystem race on temporary files
- Rapid7 Velociraptor
- CWE-377
- CVSS 7.8 High
Temporary Directory Hijacking to Local Privilege Escalation Vulnerability in org.springframework.boot:spring-boot
- Information disclosure
- CWE-377
<2.2.11.RELEASE · fixed in 2.2.11.RELEASE
GHSA-cm59-pr5q-cw85 · CVE-2022-27772 -
Insecure temporary file in openshift-origin-msg-node-mcollective
- openshift-origin-msg-node-mcollective
- CWE-377
-
phpMyAdmin unsafely handles temporary files
- CWE-377
>=2.11.0, <2.11.10 · fixed in 2.11.10
GHSA-9645-6g72-2pv8 · CVE-2008-7252 -
RPLY Predictable Tmpfile Names Allows Cache Spoofing
- CWE-377
<0.7.1 · fixed in 0.7.1
GHSA-9gcf-pq99-rjw3 · CVE-2014-1604 -
Puppet uses predictable filenames, allowing arbitrary file overwrite
- CWE-377
>=2.6, <2.6.15 || >=2.7, <2.7.13 · fixed in 2.6.15, 2.7.13
GHSA-c4mc-49hq-q275 · CVE-2012-1906 - CVSS 5.5 Medium
keycloak-httpd-client-install symlink attack vulnerability
- Path traversal
- CWE-377
<0.8 · fixed in 0.8
GHSA-vqf9-v3hc-wr54 · CVE-2017-15111 - CVSS 6.4 Medium
instack-undercloud vulnerable to symlink attack on tmp files
- Path traversal
- CWE-377
<=7.2.0 · no fixed version yet
GHSA-53wm-97p6-582f · CVE-2017-7549 - CVSS 9.9 CriticalCritical · CVSS 9+
Insecure temporary file in InHand Networks InRouter302
- InHand Networks InRouter302
- CWE-377
-
ruby_parser allows local users to overwrite arbitrary files via symlink attack on temporary file with predictable name
- CWE-377
>=2.0.2, <3.1.2 · fixed in 3.1.2
GHSA-8mvw-22r7-w6fq · CVE-2013-0162 - CVSS 7.5 High
Hadoop symlink vulnerability
- Path traversal
- CWE-377
<1.0.4 · fixed in 1.0.4
GHSA-v5c9-98f7-2h54 · CVE-2012-2945 - CVSS 9.1 CriticalCritical · CVSS 9+
Insecure Temporary File in SWHKD
- Path traversal
- CWE-377
<1.2.0 · fixed in 1.2.0
GHSA-p4jg-pccf-h82c · CVE-2022-27815 - CVSS 8.2 High
Use of insecure temporary file in Horovod
- Information disclosure
- CWE-377
<0.24.0 · fixed in 0.24.0
GHSA-47wv-vhj2-g66m · CVE-2022-0315 - CVSS 5.5 Medium
Data-transfer-project information disclosure via tmp directory
- Google LLC Data-Transfer-Project
- CWE-377
- CVSS 7.3 High
Temporary Directory Hijacking Vulnerability in Keycloak
- CWE-377
<13.0.0 · fixed in 13.0.0
GHSA-6xp6-fmc8-pmmr · CVE-2021-20202 - CVSS 5.1 Medium
cscreen: usage of fixed path /tmp/cscreen.debug
- openSUSE Factory
- CWE-377
- CVSS 5.1 Medium
grub2-once uses fixed file name in /var/tmp
- SUSE Linux Enterprise Server 15 SP4
- openSUSE Factory
- CWE-377
- CVSS 8.2 High
Insecure Temporary File in mlflow
- Information disclosure
- CWE-377
<1.23.1 · fixed in 1.23.1
GHSA-vqj2-4v8m-8vrq · CVE-2022-0736 - CVSS 4.4 Medium
Hub Package Arbitrary File Overwrite
- CWE-377
<1.12.1 · fixed in 1.12.1
GHSA-x5m6-jh4r-34mv · CVE-2014-0177 - CVSS 5.0 Medium
Exposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible
- Race condition
- Information disclosure
<2.9.12 || >=2.10.0a1, <2.10.0rc1 · fixed in 2.9.12, 2.10.0rc1
GHSA-vp9j-rghq-8jhh · CVE-2020-10744 -
Insecure temporary file in caml-light
- caml-light
- CWE-377
-
Insecure temporary file in go/golang
- go/golang
- CWE-377
- CVSS 4.4 Medium
Insecure temporary file used in com.squareup:connect
- CWE-377
<=2.20191120.0 · no fixed version yet
GHSA-q4hm-fwc9-hmv6 · CVE-2021-23331 -
Insecure temporary file in Versa VOS
- Versa VOS
- CWE-377
- CVSS 6.2 Medium
Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code
- Privilege escalation
- Information disclosure
<5.1.0 · fixed in 5.1.0
GHSA-cqxr-xf2w-943w · CVE-2021-21430 - CVSS 9.3 CriticalCritical · CVSS 9+
Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator
- Privilege escalation
- Information disclosure
<5.1.0 · fixed in 5.1.0
GHSA-23x4-m842-fmwf · CVE-2021-21428 - CVSS 4.0 Medium
Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin
- Information disclosure
- CWE-377
<5.1.0 · fixed in 5.1.0
GHSA-867q-77cc-98mv · CVE-2021-21429 - CVSS 5.0 Medium
Ansible vulnerable to Exposure of Resource to Wrong Sphere and Insecure Temporary File
- Race condition
- Information disclosure
<2.7.17 || >=2.8.0a1, <2.8.11 || >=2.9.0a1, <2.9.7 · fixed in 2.7.17, 2.8.11, 2.9.7
GHSA-g4mq-6fp5-qwcf · CVE-2020-1733 - CVSS 3.3 Low
Local DoS of VM live migration due to use of static tmp files in detach_disks.sh in s390-tools
- SUSE Linux Enterprise Server 12-SP5
- SUSE Linux Enterprise Server 15-SP2
- CWE-377
- CVSS 4.0 Medium
Information disclosure through temporary directory permissions
- gradle
- CWE-377
- CVSS 3.9 Low
Exposure of Sensitive Information to an Unauthorized Actor and Insecure Temporary File in Ansible
- Information disclosure
- CWE-377
<2.7.17 || >=2.8.0a1, <2.8.11 || >=2.9.0a1, <2.9.7 · fixed in 2.7.17, 2.8.11, 2.9.7
GHSA-vcg8-98q8-g7mj · CVE-2020-1740