CVE-2021-23331

This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded by downloadFileFromResponse will be visible to all other users on the local system. A workaround fix for this issue is to set the system property java.io.tmpdir to a safe directory as remediation. Note: This version of the SDK is end of life and no longer maintained, please upgrade to the latest version.

• https://github.com/square/connect-java-sdk/blob/master/src/main/java/com/squareup/connect/ApiClient.java%23L613Broken Link
• https://snyk.io/vuln/SNYK-JAVA-COMSQUAREUP-1065988Third Party Advisory
• https://github.com/square/connect-java-sdk/blob/master/src/main/java/com/squareup/connect/ApiClient.java%23L613Broken Link
• https://snyk.io/vuln/SNYK-JAVA-COMSQUAREUP-1065988Third Party Advisory

Published

Feb 3, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23326This affects the package @graphql-tools/git-loader before 6.…8.8
• CVE-2021-23327The package apexcharts before 3.24.0 are vulnerable to Cross…6.3
• CVE-2021-23328This affects all versions of package iniparserjs. This vulne…5.6
• CVE-2021-23329The package nested-object-assign before 1.0.4 are vulnerable…7.5
• CVE-2021-2333Vulnerability in the Oracle XML DB component of Oracle Datab…4.9
• CVE-2021-23330All versions of package launchpad are vulnerable to Command …9.8
• CVE-2021-23334Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-23335All versions of package is-user-valid are vulnerable to LDAP…7.5
• CVE-2021-23336The package python/cpython from 0 and before 3.6.13, from 3.…5.9
• CVE-2021-23337Lodash versions prior to 4.17.21 are vulnerable to Command I…7.2
• CVE-2021-23338This affects all versions of package qlib. The workflow func…7.2
• CVE-2021-23339This affects all versions before 10.1.14 and from 10.2.0 to …6.5