CVE-2018-19046

MEDIUM Year: 2018
CVSS v3 Score
4.7
Medium
CVSS v2 Score
1.9
Low
Weakness Type
CWE-200
View all →

Vulnerability Description

keepalived 2.0.8 didn't check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats. If a local attacker had previously created a file with the expected name (e.g., /tmp/keepalived.data or /tmp/keepalived.stats), with read access for the attacker and write access for the keepalived process, then this potentially leaked sensitive information.

Related Vulnerabilities

CVE-2015-3142

MEDIUM
CVSS:4.7(Medium)

The kernel-invoked coredump processor in Automatic Bug Reporting Tool (ABRT) does not properly check the ownership of files before writing core dumps to them, which allows local users to obtain sensit...

CWE-2002015

CVE-2015-7328

MEDIUM
CVSS:4.7(Medium)

Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority (CA) certificate during the...

CWE-2002015

CVE-2015-7438

MEDIUM
CVSS:4.7(Medium)

IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive cleartext web-services information by leveraging database access.

CWE-2002015

CVE-2015-7493

MEDIUM
CVSS:4.7(Medium)

IBM InfoSphere Information Server could allow a local user under special circumstances to execute commands during installation processes that could expose sensitive information.

CWE-2002015

CVE-2016-10293

MEDIUM
CVSS:4.7(Medium)

An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because...

CWE-2002016

CVE-2016-10294

MEDIUM
CVSS:4.7(Medium)

An information disclosure vulnerability in the Qualcomm power driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because...

CWE-2002016