Most recent entries from all

certfr-2024-avi-0630 — De multiples vulnérabilités ont été découvertes dans IBM QRadar. Certaines d'entre elles permettent à un attaquant de p…

certfr-2024-avi-0630

EUVD-2026-180323

fkie_cve-2016-10538

The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.

GHSA-6cpc-mj5c-m9rq — Arbitrary File Write in cli

Affected: npm: cli

Affected versions of `cli` use predictable temporary file names. If an attacker can create a symbolic link at the location of one of these temporarly file names, the attacker can arbitrarily write to any file that the user which owns the `cli` process has permission to write to.

## Proof of Concept

By creating Symbolic Links at the following locations, the target of the link can be written to. ``` lock_file = '/tmp/' + cli.app + '.pid', log_file = '/tmp/' + cli.app + '.log'; ```

## Recommendation

Update to version 1.0.0 or later.

gsd-2016-10538

UBUNTU-CVE-2016-10538

Affected: Ubuntu:16.04:LTS: node-cli, Ubuntu:18.04:LTS: node-cli

The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.