CVE-2020-10237

MEDIUM Year: 2020
CVSS v3 Score
5.5
Medium
CVSS v2 Score
2.1
Low
Weakness Type
CWE-362
View all →

Vulnerability Description

An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time, because of _createUserdataConf in install/lib/class.FroxlorInstall.php.

Related Vulnerabilities

CVE-2014-0196

MEDIUM
CVSS:5.5(Medium)

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial o...

CWE-3622014

CVE-2015-7550

MEDIUM
CVSS:5.5(Medium)

The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not properly use a semaphore, which allows local users to cause a denial of service (NULL pointer dereferen...

CWE-3622015

CVE-2016-7916

MEDIUM
CVSS:5.5(Medium)

Race condition in the environ_read function in fs/proc/base.c in the Linux kernel before 4.5.4 allows local users to obtain sensitive information from kernel memory by reading a /proc/*/environ file d...

CWE-3622016

CVE-2017-14483

MEDIUM
CVSS:5.5(Medium)

flower.initd in the Gentoo dev-python/flower package before 0.9.1-r1 for Celery Flower sets PID file ownership to a non-root account, which might allow local users to kill arbitrary processes by lever...

CWE-3622017

CVE-2017-5427

MEDIUM
CVSS:5.5(Medium)

A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. If a malicious user with local access puts chrome.manifest and other referenced fi...

CWE-3622017

CVE-2017-5986

MEDIUM
CVSS:5.5(Medium)

Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel before 4.9.11 allows local users to cause a denial of service (assertion failure and panic) via a multithre...

CWE-3622017