Arbitrary File Write via Archive Extraction (Zip Slip)

Overview github.com/u-root/u-root/pkg/uzip is a package that provides Go versions of standard Linux tools and bootloaders. It also provides tools for compiling Go programs in a single binary and creating initramfs images. Affected versions of this package are vulnerable to Arbitrary File Write vi...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview github.com/u-root/u-root/pkg/cpio is a package that provides Go versions of standard Linux tools and bootloaders. It also provides tools for compiling Go programs in a single binary and creating initramfs images. Affected versions of this package are vulnerable to Arbitrary File Write vi...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview github.com/u-root/u-root/pkg/tarutil is a package that provides Go versions of standard Linux tools and bootloaders. It also provides tools for compiling Go programs in a single binary and creating initramfs images. Affected versions of this package are vulnerable to Arbitrary File Write...

PT-2020-19697 · U Root · U-Root

Name of the Vulnerable Software and Affected Versions: github.com/u-root/u-root/pkg/tarutil versions prior to 0.7.0 Description: The issue affects the tar file extraction in the github.com/u-root/u-root/pkg/tarutil package, making it vulnerable to both leading and non-leading relative path...

CVE-2020-16116

In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal...

CVE-2020-7668 Arbitrary File Write via Archive Extraction (Zip Slip)

In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

CVE-2020-7664 Arbitrary File Write via Archive Extraction (Zip Slip)

In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview github.com/helm/helm/pkg/plugin/installer is a Kubernetes Package Manager. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. When installing Helm plugins from a tar archive over HTTP, it is possible for a malicious plugin author to...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview helm.sh/helm/v3/pkg/plugin/installer is a Kubernetes Package Manager. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. When installing Helm plugins from a tar archive over HTTP, it is possible for a malicious plugin author to injec...

wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)

It was found that the explode function of the deployment utility in jboss-cli and console that allows extraction of files from an archive does not perform necessary validation for directory traversal. This can lead to remote code execution...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview github.com/sassoftware/go-rpmutils/cpio is a package for parsing and extracting content from RPM files. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. The CPIO extraction functionality doesn't sanitize the paths of the archived...

wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)

It was found that the explode function of the deployment utility in jboss-cli and console that allows extraction of files from an archive does not perform necessary validation for directory traversal. This can lead to remote code execution...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview github.com/unknwon/cae/tz is a package that provides archiving functionality for .tar.gz archives. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. The ExtractTo function doesn't securely escape file paths in zip archives which...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview github.com/unknwon/cae/zip is a package that provides archiving functionality for .zip archives. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. The ExtractTo function doesn't securely escape file paths in zip archives which inclu...

CVE-2020-10859

Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted AppDependency API request...

Directory traversal

Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted AppDependency API request...

CVE-2020-10859

The CVE-2020-10859 entry applies to Zoho ManageEngine Desktop Central (before 10.0.484). The vulnerability is a Directory Traversal in the AppDependency API that, when an authenticated user issues a crafted ZIP extraction request, allows arbitrary file writes on the target system. This is trigger...

DEBIAN-CVE-2020-1737

A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the winunzip module as the extracted files are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview dariusiii/zipper is a Simple Wrapper around the ZipArchive methods with some handy functions. This package is an updated fork of Chumper/Zipper. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. ZIP Path traversal is possible during...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview chumper/zipper is a little neat helper for the ZipArchive methods with handy functions. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. ZIP Path traversal is possible during extraction due to no validation and sanitization of...