Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
CISOfy Lynis 竞争条件问题漏洞
Vulnerability Description
CISOfy Lynis是荷兰CISOfy公司的一款支持多个平台的系统安全审核工具。 CISOfy Lynis 3.0.0之前版本中存在竞争条件问题漏洞。攻击者可利用该漏洞绕过符号链接检查，在日志和报告中操作数据，进而造成拒绝服务，检索系统信息或提升权限。
CVSS Information
N/A
Vulnerability Type
N/A