CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-362

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-1999-0861 362 +Info 1999-08-11 2018-10-12
2.6
None Remote High Not required Partial None None
Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext.
2 CVE-2000-0864 362 +Priv 2000-11-14 2017-10-10
6.2
None Local High Not required Complete Complete Complete
Race condition in the creation of a Unix domain socket in GNOME esound 0.2.19 and earlier allows a local user to change the permissions of arbitrary files and directories, and gain additional privileges, via a symlink attack.
3 CVE-2002-2244 362 DoS 2002-12-31 2017-07-29
2.1
None Local Low Not required None None Partial
Akfingerd 0.5 and earlier versions allow local users to cause a denial of service (crash) via a .plan with a symlink to /dev/urandom or other device, then disconnecting while data is being transferred, which causes a SIGPIPE error that Akfingerd cannot handle.
4 CVE-2002-2374 362 2002-12-31 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in pprosetup in Sun PatchPro 2.0 has unknown impact and attack vectors related to "unsafe use of temporary files."
5 CVE-2003-1438 362 2003-12-31 2017-07-29
4.3
None Remote Medium Not required Partial None None
Race condition in BEA WebLogic Server and Express 5.1 through 7.0.0.1, when using in-memory session replication or replicated stateful session beans, causes the same buffer to be provided to two users, which could allow one user to see session data that was intended for another user.
6 CVE-2003-1562 362 2003-12-31 2008-09-05
7.6
None Remote High Not required Complete Complete Complete
sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.
7 CVE-2004-2697 362 +Priv 2004-12-31 2017-07-29
6.9
None Local Medium Not required Complete Complete Complete
The Inventory Scout daemon (invscoutd) 1.3.0.0 and 2.0.2 for AIX 4.3.3 and 5.1 allows local users to gain privileges via a symlink attack on a command line argument (log file). NOTE: this might be related to CVE-2006-5002.
8 CVE-2004-2698 362 DoS 2004-12-31 2017-07-29
6.9
None Local Medium Not required Complete Complete Complete
Race condition in IMWheel 1.0.0pre11 and earlier, when running with the -k option, allows local users to cause a denial of service (IMWheel crash) and possibly modify arbitrary files via a symlink attack on the imwheel.pid file.
9 CVE-2005-2352 362 2019-11-01 2019-11-06
6.8
None Remote Medium Not required Partial Partial Partial
I race condition in Temp files was found in gs-gpl before 8.56 addons scripts.
10 CVE-2005-3240 362 Exec Code 2005-12-31 2021-07-23
5.1
None Remote High Not required Partial Partial Partial
Race condition in Microsoft Internet Explorer allows user-assisted attackers to overwrite arbitrary files and possibly execute code by tricking a user into performing a drag-and-drop action from certain objects, such as file objects within a folder view, then predicting the drag action, and re-focusing to a malicious window.
11 CVE-2005-4883 362 DoS 2009-11-20 2009-11-23
4.3
None Remote Medium Not required None None Partial
Race condition in Philippe Jounin Tftpd32 before 2.80 allows remote attackers to cause a denial of service (daemon crash) via invalid "connect frames."
12 CVE-2006-0039 362 2006-05-19 2017-10-11
4.7
None Local High Not required Partial None Complete
Race condition in the do_add_counters function in netfilter for Linux kernel 2.6.16 allows local users with CAP_NET_ADMIN capabilities to read kernel memory by triggering the race condition in a way that produces a size value that is inconsistent with allocated memory, which leads to a buffer over-read in IPT_ENTRY_ITERATE.
13 CVE-2006-1057 362 +Priv 2006-04-25 2018-10-03
3.7
None Local High Not required Partial Partial Partial
Race condition in daemon/slave.c in gdm before 2.14.1 allows local users to gain privileges via a symlink attack when gdm performs chown and chgrp operations on the .ICEauthority file.
14 CVE-2006-2094 362 2006-04-29 2021-07-23
5.1
None Remote High Not required Partial Partial Partial
Microsoft Internet Explorer before Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1, when Prompt is configured in Security Settings, uses modal dialogs to verify that a user wishes to run an ActiveX control or perform other risky actions, which allows user-assisted remote attackers to construct a race condition that tricks a user into clicking an object or pressing keys that are actually applied to a "Yes" approval for executing the control.
15 CVE-2006-4245 362 2019-11-06 2020-08-18
6.8
None Remote Medium Not required Partial Partial Partial
archivemail 0.6.2 uses temporary files insecurely leading to a possible race condition.
16 CVE-2006-4801 362 Exec Code 2006-09-14 2011-03-08
6.2
None Local High Not required Complete Complete Complete
Race condition in Deja Vu, as used in Roxio Toast Titanium 7 and possibly other products, allows local users to execute arbitrary code via temporary files, including dejavu_manual.rb, which are executed with raised privileges.
17 CVE-2006-5051 362 DoS Exec Code 2006-09-27 2017-10-11
9.3
None Remote Medium Not required Complete Complete Complete
Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free.
18 CVE-2006-5178 362 Bypass 2006-10-10 2018-10-30
6.2
None Local High Not required Complete Complete Complete
Race condition in the symlink function in PHP 5.1.6 and earlier allows local users to bypass the open_basedir restriction by using a combination of symlink, mkdir, and unlink functions to change the file path after the open_basedir check and before the file is opened by the underlying system, as demonstrated by symlinking a symlink into a subdirectory, to point to a parent directory via .. (dot dot) sequences, and then unlinking the resulting symlink.
19 CVE-2006-6275 362 DoS 2006-12-04 2018-10-30
4.7
None Local Medium Not required None None Complete
Race condition in the kernel in Sun Solaris 8 through 10 allows local users to cause a denial of service (panic) via unspecified vectors, possibly related to the exitlwps function and SIGKILL and /proc PCAGENT signals.
20 CVE-2007-0099 362 DoS Exec Code Mem. Corr. 2007-01-08 2018-10-16
9.3
None Remote Medium Not required Complete Complete Complete
Race condition in the msxml3 module in Microsoft XML Core Services 3.0, as used in Internet Explorer 6 and other applications, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via many nested tags in an XML document in an IFRAME, when synchronous document rendering is frequently disrupted with asynchronous events, as demonstrated using a JavaScript timer, which can trigger NULL pointer dereferences or memory corruption, aka "MSXML Memory Corruption Vulnerability."
21 CVE-2007-0997 362 DoS +Priv +Info 2007-09-18 2008-09-05
6.9
None Local Medium Not required Complete Complete Complete
Race condition in the tee (sys_tee) system call in the Linux kernel 2.6.17 through 2.6.17.6 might allow local users to cause a denial of service (system crash), obtain sensitive information (kernel memory contents), or gain privileges via unspecified vectors related to a potentially dropped ipipe lock during a race between two pipe readers.
22 CVE-2007-1249 362 2007-03-03 2017-07-29
6.8
None Remote Medium Not required Partial Partial Partial
MoveSortedContentAction in C1 Financial Services Contelligent 9.1.4 does not check "the additional environment security configuration," which allows remote attackers with write permissions to reorder components.
23 CVE-2007-1741 362 Exec Code +Priv 2007-04-13 2017-07-29
6.2
None Local High Not required Complete Complete Complete
Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation, and their usage, allow local users to gain privileges and execute arbitrary code by renaming directories or performing symlink attacks. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."
24 CVE-2007-2654 362 2007-05-14 2008-11-13
4.4
None Local Medium Not required Partial Partial Partial
xfs_fsr in xfsdump creates a .fsr temporary directory with insecure permissions, which allows local users to read or overwrite arbitrary files on xfs filesystems.
25 CVE-2007-3091 362 Exec Code 2007-06-06 2021-07-23
7.1
None Remote Medium Not required None None Complete
Race condition in Microsoft Internet Explorer 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 allows remote attackers to execute arbitrary code or perform other actions upon a page transition, with the permissions of the old page and the content of the new page, as demonstrated by setInterval functions that set location.href within a try/catch expression, aka the "bait & switch vulnerability" or "Race Condition Cross-Domain Information Disclosure Vulnerability."
26 CVE-2007-3478 362 DoS 2007-06-28 2018-10-16
4.3
None Remote Medium Not required None None Partial
Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving truetype font (TTF) support.
27 CVE-2007-4696 362 +Info 2007-11-15 2011-03-08
4.3
None Remote Medium Not required Partial None None
Race condition in WebCore in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to obtain information for forms from other sites via unknown vectors related to "page transitions" in Safari.
28 CVE-2007-4774 362 Bypass 2020-01-15 2020-02-04
4.3
None Remote Medium Not required None Partial None
The Linux kernel before 2.4.36-rc1 has a race condition. It was possible to bypass systrace policies by flooding the ptraced process with SIGCONT signals, which can can wake up a PTRACED process.
29 CVE-2007-5132 362 DoS 2007-09-27 2017-09-29
4.9
None Local Low Not required None None Complete
Race condition in the kernel in Sun Solaris 8 through 10 allows local users to cause a denial of service (panic) via unspecified vectors related to "the handling of thread contexts."
30 CVE-2007-5154 362 2007-10-01 2017-07-29
5.8
None Remote Medium Not required Partial Partial None
Session fixation vulnerability in Aipo and Aipo ASP 3.0.1.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.
31 CVE-2007-5794 362 2007-11-13 2018-10-15
4.3
None Remote Medium Not required Partial None None
Race condition in nss_ldap, when used in applications that are linked against the pthread library and fork after a call to nss_ldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong mailboxes being returned, but other applications might also be affected.
32 CVE-2007-5847 362 +Info 2007-12-19 2017-07-29
6.6
None Local Low Not required Complete Complete None
Race condition in the CFURLWriteDataAndPropertiesToResource API in Core Foundation in Apple Mac OS X 10.4.11 creates files with insecure permissions, which might allow local users to obtain sensitive information.
33 CVE-2007-6077 362 2007-11-21 2019-08-08
6.8
None Remote Medium Not required Partial Partial Partial
The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.
34 CVE-2007-6180 362 DoS 2007-11-30 2017-07-29
7.6
None Local Network Medium Not required Partial Complete Complete
Race condition in the Remote Procedure Call kernel module (rpcmod) in Sun Solaris 8 through 10 allows local users to cause a denial of service (NULL dereference and panic) via unspecified vectors.
35 CVE-2007-6216 362 DoS 2007-12-04 2018-10-30
4.7
None Local Medium Not required None None Complete
Race condition in the Fibre Channel protocol (fcp) driver and Devices filesystem (devfs) in Sun Solaris 10 allows local users to cause a denial of service (system hang) via some programs that access hardware resources, as demonstrated by the (1) cfgadm and (2) format programs.
36 CVE-2007-6599 362 DoS 2008-01-04 2018-10-26
4.3
None Remote Medium Not required None None Partial
Race condition in fileserver in OpenAFS 1.3.50 through 1.4.5 and 1.5.0 through 1.5.27 allows remote attackers to cause a denial of service (daemon crash) by simultaneously acquiring and giving back file callbacks, which causes the handler for the GiveUpAllCallBacks RPC to perform linked-list operations without the host_glock lock.
37 CVE-2008-0055 362 DoS +Priv 2008-03-18 2017-08-08
7.2
None Local Low Not required Complete Complete Complete
Foundation in Apple Mac OS X 10.4.11 creates world-writable directories while NSFileManager copies files recursively and only modifies the permissions afterward, which allows local users to modify copied files to cause a denial of service and possibly gain privileges.
38 CVE-2008-0058 362 Exec Code 2008-03-18 2017-08-08
5.8
None Remote Medium Not required None Partial Partial
Race condition in the NSURLConnection cache management functionality in Foundation for Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via unspecified manipulations that cause messages to be sent to a deallocated object.
39 CVE-2008-0059 362 Exec Code 2008-03-18 2017-08-08
5.8
None Remote Medium Not required None Partial Partial
Race condition in NSXML in Foundation for Apple Mac OS X 10.4.11 allows context-dependent attackers to execute arbitrary code via a crafted XML file, related to "error handling logic."
40 CVE-2008-0933 362 DoS 2008-02-25 2017-09-29
4.7
None Local Medium Not required None None Complete
Multiple race conditions in the CPU Performance Counters (cpc) subsystem in the kernel in Sun Solaris 10 allow local users to cause a denial of service (panic) via unspecified vectors related to kcpc_unbind and kcpc_restore.
41 CVE-2008-1375 362 DoS +Priv 2008-05-02 2020-08-26
6.9
None Local Medium Not required Complete Complete Complete
Race condition in the directory notification subsystem (dnotify) in Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1, allows local users to cause a denial of service (OOPS) and possibly gain privileges via unspecified vectors.
42 CVE-2008-1570 362 2008-03-31 2017-08-08
6.9
None Local Medium Not required Complete Complete Complete
Race condition in the create_lockpath function in policyd-weight 0.1.14 beta-16 allows local users to modify or delete arbitrary files by creating the LOCKPATH directory, then modifying it after the symbolic link check occurs. NOTE: this is due to an incomplete fix for CVE-2008-1569.
43 CVE-2008-1684 362 2008-04-06 2017-09-29
4.7
None Local Medium Not required None None Complete
inetd on Sun Solaris 10, when debug logging is enabled, allows local users to write to arbitrary files via a symlink attack on the /var/tmp/inetd.log temporary file.
44 CVE-2008-2311 362 Exec Code 2008-07-01 2017-08-08
7.6
None Remote High Not required Complete Complete Complete
Launch Services in Apple Mac OS X before 10.5, when Open Safe Files is enabled, allows remote attackers to execute arbitrary code via a symlink attack, probably related to a race condition and automatic execution of a downloaded file.
45 CVE-2008-2365 362 DoS 2008-06-30 2018-10-30
4.7
None Local Medium Not required None None Complete
Race condition in the ptrace and utrace support in the Linux kernel 2.6.9 through 2.6.25, as used in Red Hat Enterprise Linux (RHEL) 4, allows local users to cause a denial of service (oops) via a long series of PTRACE_ATTACH ptrace calls to another user's process that trigger a conflict between utrace_detach and report_quiescent, related to "late ptrace_may_attach() check" and "race around &dead_engine_ops setting," a different vulnerability than CVE-2007-0771 and CVE-2008-1514. NOTE: this issue might only affect kernel versions before 2.6.16.x.
46 CVE-2008-2418 362 DoS 2008-05-23 2017-09-29
4.7
None Local Medium Not required None None Complete
Race condition in the STREAMS Administrative Driver (sad) in Sun Solaris 10 allows local users to cause a denial of service (panic) via unknown vectors.
47 CVE-2008-2538 362 2008-06-03 2017-09-29
6.9
None Local Medium Not required Complete Complete Complete
Unspecified vulnerability in crontab on Sun Solaris 8 through 10, and OpenSolaris before snv_93, allows local users to insert cron jobs into the crontab files of arbitrary users via unspecified vectors.
48 CVE-2008-2958 362 2008-07-01 2017-08-08
4.4
None Local Medium Not required Partial Partial Partial
Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.
49 CVE-2008-3646 362 2008-10-10 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
The Postfix configuration file in Mac OS X 10.5.5 causes Postfix to be network-accessible when mail is sent from a local command-line tool, which allows remote attackers to send mail to local Mac OS X users.
50 CVE-2008-4229 362 2008-11-25 2011-03-08
3.7
None Local High Not required Partial Partial Partial
Race condition in the Passcode Lock feature in Apple iPhone OS 2.0 through 2.1 and iPhone OS for iPod touch 2.0 through 2.1 allows physically proximate attackers to remove the lock and launch arbitrary applications by restoring the device from a backup.
Total number of vulnerabilities : 895   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.