CWE-367

{
  "affected": [],
  "aliases": [
    "CVE-2024-41779"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-367"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-22T12:15:18Z",
    "severity": "CRITICAL"
  },
  "details": "IBM Engineering Systems Design Rhapsody - Model Manager 7.0.2 and 7.0.3\u00a0could allow a remote attacker to bypass security restrictions, caused by a race condition. By sending a specially crafted request, an attacker could exploit this vulnerability to remotely execute code.",
  "id": "GHSA-m7v8-cfx4-v2vg",
  "modified": "2025-08-15T18:31:07Z",
  "published": "2024-11-22T12:39:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41779"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7172535"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "crayon"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-35889"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-367"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-19T20:56:31Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "An issue was discovered in the crayon crate through 2020-08-31 for Rust. A TOCTOU issue has a resultant memory safety violation via HandleLike.",
  "id": "GHSA-m833-jv95-mfjh",
  "modified": "2021-08-19T20:56:31Z",
  "published": "2021-08-25T20:48:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35889"
    },
    {
      "type": "WEB",
      "url": "https://github.com/shawnscode/crayon/issues/87"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/shawnscode/crayon"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2020-0037.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Memory safety violation in crayon"
}

{
  "affected": [],
  "aliases": [
    "CVE-2011-4126"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-367"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-10-27T01:15:00Z",
    "severity": "HIGH"
  },
  "details": "Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to anywhere.",
  "id": "GHSA-m85p-c5xr-7h82",
  "modified": "2022-04-22T00:24:29Z",
  "published": "2022-04-22T00:24:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4126"
    },
    {
      "type": "WEB",
      "url": "https://bugs.launchpad.net/calibre/+bug/885027"
    },
    {
      "type": "WEB",
      "url": "https://git.zx2c4.com/calibre-mount-helper-exploit/about"
    },
    {
      "type": "WEB",
      "url": "https://lwn.net/Articles/464824"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2011/11/02/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-0163"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-367"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-13T17:15:46Z",
    "severity": "MODERATE"
  },
  "details": "Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain a TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gain access to otherwise unauthorized resources.",
  "id": "GHSA-m88f-jj9j-8c3p",
  "modified": "2024-03-13T18:31:35Z",
  "published": "2024-03-13T18:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0163"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/kbdoc/en-us/000222756/dsa-2024-003-security-update-for-dell-poweredge-server-bios-for-a-time-of-check-time-of-use-toctou-vulnerability"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "coreutils"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35364"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-367"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-30T17:31:34Z",
    "nvd_published_at": "2026-04-22T17:16:39Z",
    "severity": "MODERATE"
  },
  "details": "A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation. A local attacker with write access to the destination directory can exploit this window to replace the destination with a symbolic link. The subsequent privileged move operation will follow the symlink, allowing the attacker to redirect the write and overwrite an arbitrary target file with contents from the source.",
  "id": "GHSA-m976-87wm-48fm",
  "modified": "2026-04-30T17:31:35Z",
  "published": "2026-04-22T18:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35364"
    },
    {
      "type": "WEB",
      "url": "https://github.com/uutils/coreutils/issues/10015"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/uutils/coreutils"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "remove_dir_all"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-366",
      "CWE-367"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-24T16:23:59Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "The `remove_dir_all` crate is a Rust library that offers additional features over the Rust standard library `fs::remove_dir_all` function. It suffers the same class of failure as the code it was layering over: TOCTOU race conditions, with the ability to cause arbitrary paths to be deleted by substituting a symlink for a path after the type of the path was checked.\n\nThanks to the Rust security team for identifying the problem and alerting us to it.",
  "id": "GHSA-mc8h-8q98-g5hr",
  "modified": "2023-02-24T16:23:59Z",
  "published": "2023-02-24T16:23:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/XAMPPRocky/remove_dir_all/security/advisories/GHSA-mc8h-8q98-g5hr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/XAMPPRocky/remove_dir_all/commit/7247a8b6ee59fc99bbb69ca6b3ca4bfd8c809ead"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/XAMPPRocky/remove_dir_all"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2023-0018.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-13818"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-367"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-06T14:16:37Z",
    "severity": "HIGH"
  },
  "details": "Local privilege escalation vulnerability via insecure temporary batch file execution in ESET Management Agent",
  "id": "GHSA-mc8x-4j6m-qj3r",
  "modified": "2026-02-18T18:30:23Z",
  "published": "2026-02-06T15:31:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13818"
    },
    {
      "type": "WEB",
      "url": "https://support.eset.com/en/ca8913-eset-customer-advisory-local-privilege-escalation-via-insecure-temporary-batch-file-execution-in-eset-management-agent-for-windows-fixed"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.11.3"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "at.yawk.lz4:lz4-java"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.11.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.lz4:lz4-java"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.0"
            },
            {
              "last_affected": "1.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-106451"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-367",
      "CWE-377"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T20:35:51Z",
    "nvd_published_at": "2026-10-06T20:17:27Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nWhen no system-installed `liblz4-java` is found, `net.jpountz.util.Native.load()` extracts the bundled native library to `java.io.tmpdir` and loads it with `System.load`. The path of the extracted library can be predicted before it is created, and the library file is opened without exclusive creation. Another local user who can write to the same temporary directory can therefore create the file first and control the code that is loaded.\n\n### Details\n\n```java\ntempLibLock = File.createTempFile(\"liblz4-java-\", \".\" + os().libExtension + \".lck\");\ntempLib = new File(tempLibLock.getAbsolutePath().replaceFirst(\".lck$\", \"\"));\n// copy to tempLib\ntry (FileOutputStream out = new FileOutputStream(tempLib)) { ... }\n...\nSystem.load(tempLib.getAbsolutePath());\n```\n\nOnly the `.lck` file is created safely, with a random name and exclusive creation. The library path is the `.lck` name without the `.lck` suffix, and nothing reserves it. `new FileOutputStream(tempLib)` opens it with `O_CREAT|O_TRUNC` and follows symlinks.\n\nIn a shared, world-writable temporary directory, another user can watch for the `.lck` file and create the corresponding library file before it is opened. If they win that race, they own the file. The victim then writes into the attacker-owned file, and the attacker can overwrite it again before `System.load`.\n\nWhether this can be exploited depends on the host:\n\n- With `fs.protected_regular = 0`, the attacker can pre-create a world-writable file, and their code is then loaded into the victim\u0027s JVM.\n- With `fs.protected_regular \u003e= 1` (the default on many systemd-based distributions), the victim\u0027s open fails. The library then fails to load and the library falls back to the Java implementations, so the attacker can only cause a denial of service.\n- A symlink variant is blocked by `fs.protected_symlinks = 1`.\n- Temporary directories without the sticky bit, or shared across users in containers, are exploitable whatever these settings are.\n\nThis behaviour was introduced upstream in commit c3ddae5 (lz4-java 1.7.0), which swapped which of the two files is created with `createTempFile`.\n\n### Impact\n\nA local user who can write to the same temporary directory as a victim process that uses the bundled JNI library may be able to execute code as the victim. Exploitation requires a shared temporary directory, host settings that permit it, and winning a race.\n\nThe issue does not apply if `liblz4-java` is found on `java.library.path`, if `java.io.tmpdir` is private to the user (for example systemd `PrivateTmp`, or a per-user temporary directory), or if only the Java implementations are used.\n\n### Patch\n\nFixed in lz4-java 1.11.4. The native library is now extracted directly into a file created by `File.createTempFile`, which has a random name and is created exclusively, so a file or symlink planted in advance cannot be reused. The `.lck` lock files are no longer used. Instead, the startup cleanup removes stale `liblz4-java-*` temporary files (including `.lck` files left by older versions) only once they are more than one hour old.\n\nFor older versions, the workaround is to set `java.io.tmpdir` to a directory writable only by the application user, or install `liblz4-java` on `java.library.path`.",
  "id": "GHSA-mcr4-qmvw-px4g",
  "modified": "2026-10-07T20:35:51Z",
  "published": "2026-10-07T20:35:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-mcr4-qmvw-px4g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106451"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/yawkat/lz4-java"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/crossplane/crossplane-runtime/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.4.0-rc.0"
            },
            {
              "fixed": "2.4.0-rc.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.0-rc.0"
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.3.2"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/crossplane/crossplane-runtime/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-345",
      "CWE-367"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-27T17:25:25Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nCrossplane allows package signature verification to be configured via the `ImageConfig` mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them.\n\nWhen a package is installed using a tag reference (e.g., a semantic version), a malicious OCI registry could serve a correctly signed image for verification, then subsequently serve an unsigned image for installation. This is possible because Crossplane resolves the tag reference separately for each step.\n\nThis vulnerability is relevant only for users who do all three of the following:\n\n1. Configure signature verification for packages,\n2. Install packages using tag references rather than digests, and\n3. Install packages from registries they do not control.\n\n## Mitigation\n\nInstalling packages by image digest rather than using tags avoids this issue.\n\n## Fix\n\nThe package manager has been updated to resolve tag references once and use the resulting digest for both signature verification and image fetching. This ensures that Crossplane pulls the same content that had its signature verified. The fix has been applied to Crossplane\u0027s `main` branch and backported to the v2.3 and v2.2 release branches; it will be released in v2.3.3 and v2.2.3.\n\n## Credits\n\nThis issue was reported, independently, by @bugbunny-research and @tonghuaroot.",
  "id": "GHSA-mf7q-r4rv-jv94",
  "modified": "2026-08-27T17:25:25Z",
  "published": "2026-08-27T17:25:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/crossplane/crossplane-runtime/security/advisories/GHSA-mf7q-r4rv-jv94"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/crossplane/crossplane-runtime"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Crossplane\u0027s TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-34413"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-367"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-27T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "All versions of the Zoom Plugin for Microsoft Outlook for MacOS before 5.3.52553.0918 contain a Time-of-check Time-of-use (TOC/TOU) vulnerability during the plugin installation process. This could allow a standard user to write their own malicious application to the plugin directory, allowing the malicious application to execute in a privileged context.",
  "id": "GHSA-mgjc-79v8-mc48",
  "modified": "2022-05-24T19:15:50Z",
  "published": "2022-05-24T19:15:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34413"
    },
    {
      "type": "WEB",
      "url": "https://cwe.mitre.org/data/definitions/367.html"
    },
    {
      "type": "WEB",
      "url": "https://explore.zoom.us/en/trust/security/security-bulletin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}