CVE-2018-10057: Improper Limitation of a Pathname to a Restricted Directory

The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to write the miner configuration file to arbitrary locations on the server due to missing basedir restrictions absolute directory traversal...

CVE-2018-1000194: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing the agent-to-master security subsystem protection...

CVE-2018-8008: Improper Limitation of a Pathname to a Restricted Directory

Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

PT-2018-18378

Name of the Vulnerable Software and Affected Versions: Apache Storm versions 1.0.6 and earlier Apache Storm versions 1.2.1 and earlier Apache Storm version 1.1.2 and earlier Description: The issue allows for an arbitrary file write, which can be achieved by using a specially crafted zip archive, ...

PT-2018-1392

Name of the Vulnerable Software and Affected Versions zip4j versions prior to 1.3.3 Description The issue is related to a directory traversal vulnerability, also known as 'Zip-Slip', which allows attackers to write to arbitrary files via a ../ dot dot slash in a Zip archive entry that is mishandl...

PT-2018-3234

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 67.0.3396.62 Description A precision error in the Skia library allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. This issue is related to a buffer overflow, which can be...

ASUSTOR AS6202T ADM Unrestricted File Upload Vulnerability (CNVD-2018-10309)

ASUSTOR AS6202T ADM is a dedicated operating system for ASUSTOR NAS storage devices from ASUSTOR. A security vulnerability exists in the upload.cgi file in ASUSTOR AS6202T ADM version 3.1.0.RFQ3. An attacker can exploit the vulnerability by uploading data with the help of the 'filename' POST...

Inteno IOPSYS p910nd Arbitrary File Read Vulnerability

Inteno IOPSYS is a suite of open service delivery platforms from Inteno Broadband Technologies in Sweden. The platform consists of a gateway operating system, a home portal, and a variety of software development kits. p910nd is one of the print daemons. A security vulnerability exists in p910nd o...

Pivotal Spring Integration Zip Arbitrary File Write Vulnerability

Pivotal Spring Integration Zip is the United States Pivotal Software, Inc. of a compression/uncompression components used in Spring. An arbitrary file write vulnerability exists in Pivotal Spring Integration Zip. This allows an attacker to write arbitrary files to an affected system...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview org.springframework.integration:spring-integration-zip provides Zip un- compression support. Affected versions of the package are vulnerable to Arbitrary File Write via Archive Extraction AKA "Zip Slip". It is exploited using a specially crafted zip archive, that holds path traversal...

Path traversal

Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal...

CVE-2018-1263

Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal...

CVE-2018-1263

CVE-2018-1263 affects spring-integration-zip (prior to 1.0.2 per initial, with later references noting fixes up to 1.0.4). The flaw is a path-traversal during archive extraction, where filenames are concatenated to the target directory, allowing an arbitrary file write outside the intended folder...

CVE-2018-1263

Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal...

Pivotal Spring-integration-zip Arbitrary File Write Vulnerability

Pivotal Spring-integration-zip is a U.S. Pivotal Software, Inc. used in Spring in the compression/decompression components. An arbitrary file write vulnerability exists in Pivotal Spring-integration-zip versions prior to 1.0.1. The vulnerability can be exploited to write arbitrary files with a...

CVE-2018-1263: Improper Limitation of a Pathname to a Restricted Directory

Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal...

PT-2018-11293

Name of the Vulnerable Software and Affected Versions spring-integration-zip versions prior to 1.0.2 Description The issue allows for an arbitrary file write, which can be achieved by using a specially crafted zip archive, as well as other archives such as bzip2, tar, xz, war, cpio, and 7z, that...

Arbitrary File Write

spring-integration-zip is vulnerable to arbitrary file write. The library is missing a path check during the unzipping process, allowing a malicious user to pass a file path outside the intended directory, which can then be used to write arbitrary files within a user application. This vulnerabili...

Path traversal

Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z that holds path traversal filenames. So when the filename gets concatenated to th...

CVE-2018-1261

Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z that holds path traversal filenames. So when the filename gets concatenated to th...