6822 matches found
CVE-2020-23171
A vulnerability in all versions of Nim-lang allows unauthenticated attackers to write files to arbitrary directories via a crafted zip file with dot-slash characters included in the name of the crafted file...
@adaptable/client (>=0.0.9, <=1.26.0), @adaptable/cloud (>=0.0.1, <=1.28.0) +359 more potentially affected by CVE-2021-32804 via tar (>=6.0.0, <=6.1.0)
tar NPM version =6.0.0, =0.0.9, =0.0.1, =1.6.0, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.1.0, =0.6.5, =1.1.0, =1.0.0, =0.0.2, =0.1.0, =0.1.8 and more Source cves: CVE-2021-32804 Source advisory: OSV:GHSA-3JFQ-G458-7QM9...
@bloq/create-package (1.2.0), @nrwl/insights (>=0.1.0, <=8.12.4) +21 more potentially affected by CVE-2021-32803 via tar (>=5.0.2, <=5.0.5)
tar NPM version =5.0.2, =0.1.0, =8.12.4, =8.11.0-alpha.0, =0.4.0-8, =0.0.2-dependabot-npm-and-yarn-decompress-4-2-1-75c8bb4f0266fca89b3fc3fe0c4c93324e226adb, =3.0.0, =3.6.20, =2.2.0, =1.10.1, =2.3.1, =0.10.0-dev2, =7.0.0, =0.9.0, =0.9.1 and more Source cves: CVE-2021-32803 Source advisory:...
(Pwn2Own) Microsoft Exchange Server OAB Arbitrary File Write Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Exchange Server. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the OAB service. T...
(Pwn2Own) Microsoft Exchange Server Arbitrary File Write Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Exchange Server. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of...
Elements-IT HTTP Commander 路径遍历漏洞
Elements-IT HTTP Commander is a server-hosted, web-based file management solution from Elements-IT Germany. It provides basic functionality for working with files creating, copying, deleting, etc. and many other additional features, such as integration with cloud services, online editing of Offic...
Arbitrary File Write via Archive Extraction (Zip Slip)
Overview baserproject/basercms is a Content management system based on CakePHP. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. In the admin panel of basercms, an administrator with privileges to perform maintenance operations, has access ...
IBM DB2 11.5 < 11.5.6 FP0 Multiple Vulnerabilities (UNIX)
According to its version, the installation of IBM DB2 running on the remote host is 11.5 prior to 11.5.6 FP0. It is, therefore, affected by multiple vulnerabilities including the following: - IBM DB2 is affected by a flaw which could allow an unauthenticated, local user to to access and change...
Arbitrary File Write
Dovecot is vulnerable to arbitrary file write. It does not correctly escape kid and azp fields in JWT tokens. This may be used to supply attacker controlled keys to validate tokens in some configurations. This requires attacker to be able to write files to local disk...
github.com/sassoftware/go-rpmutils Arbitrary File Write via Archive Extraction (Zip Slip)
The CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading .. which leads in file extraction outside of the current directory. Note, the fixing commit was applied to all affected versions which were re-released...
GHSA-9423-6C93-GPP8 github.com/sassoftware/go-rpmutils Arbitrary File Write via Archive Extraction (Zip Slip)
The CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading .. which leads in file extraction outside of the current directory. Note, the fixing commit was applied to all affected versions which were re-released...
Cleo LexiCom 路径遍历漏洞
Cleo LexiCom is an integrated platform from Cleo, Inc. Accelerate EDI automation, speed trade partner on-boarding and easily resolve EDI issues. A path traversal vulnerability exists in Cleo LexiCom 5.5.0.0, which originates in an AS2 message where the sender can specify a filename that can conta...
CVE-2021-26473
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebserviceo.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server...
CVE-2021-26473
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebserviceo.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server...
Calipso Arbitrary File Write via Archive Extraction (Zip Slip)
This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through the module install functionality...
GHSA-JXCC-G75X-QGW9 Calipso Arbitrary File Write via Archive Extraction (Zip Slip)
This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through the module install functionality...
Arbitrary File Write
calipso is vulnerable to arbitrary file write. A malicious module can overwrite files on an arbitrary file system through the module install functionality...
CVE-2021-23391 Arbitrary File Write via Archive Extraction (Zip Slip)
This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through the module install functionality...
Arbitrary File Write via Archive Extraction (Zip Slip)
Overview calipso is a Calipso is a simple NodeJS content management system based on Express, Connect & Mongoose. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. It is possible for a malicious module to overwrite files on an arbitrary file...