CVE-2024-1186

A vulnerability classified as problematic was found in Munsoft Easy Archive Recovery 2.0. This vulnerability affects unknown code of the component Registration Key Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the...

Code injection

A vulnerability classified as problematic was found in Munsoft Easy Archive Recovery 2.0. This vulnerability affects unknown code of the component Registration Key Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the...

CVE-2024-1186 Munsoft Easy Archive Recovery Registration Key denial of service

A vulnerability classified as problematic was found in Munsoft Easy Archive Recovery 2.0. This vulnerability affects unknown code of the component Registration Key Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the...

CVE-2024-1186

CVE-2024-1186 affects Munsoft Easy Archive Recovery 2.0, specifically the Registration Key Handler component. The issue allows denial-of-service via a local attack; the exploit has been disclosed publicly. The vendor reportedly did not respond to disclosure. No vendor-provided fix/version is deta...

PT-2024-20695 · Xenforo · Xenforo

Name of the Vulnerable Software and Affected Versions: XenForo versions prior to 2.2.14 Description: The issue allows Directory Traversal with write access by an authenticated user who has permissions to administer styles. This is possible when using a ZIP archive for Styles Import...

Munsoft Easy Archive Recovery Security Vulnerability

Munsoft Easy Archive Recovery is a file recovery application from Munsoft Corporation. A security vulnerability exists in Munsoft Easy Archive Recovery version 2.0, which originates from the component Registration Key Handler that can cause a denial of service...

CVE-2024-25006

XenForo before 2.2.14 allows Directory Traversal with write access by an authenticated user who has permissions to administer styles, and uses a ZIP archive for Styles Import...

CVE-2024-24579

stereoscope is a go library for processing container images and simulating a squash filesystem. Prior to version 0.0.1, it is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary director...

Design/Logic Flaw

stereoscope is a go library for processing container images and simulating a squash filesystem. Prior to version 0.0.1, it is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary director...

CVE-2024-24579 Tar path traversal in stereoscope when processing OCI tar archives

stereoscope is a go library for processing container images and simulating a squash filesystem. Prior to version 0.0.1, it is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary director...

CVE-2024-24579

The set of documents identifies a path-traversal vulnerability in the Go library stereoscope (containers/image processing). Specifically, the CVE-2024-24579 entry describes a flaw prior to v0.0.1 where crafting an OCI tar archive can cause writes to paths outside the unarchive temporary directory...

PT-2024-20466 · Unknown · Stereoscope

Name of the Vulnerable Software and Affected Versions: stereoscope versions prior to 0.0.1 Description: It is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory. This issue is...

MGASA-2024-0019 Updated zlib packages fix a security vulnerability

Updated zlib packages fix a security vulnerability: Directory traversal vulnerability in the doextractcurrentfile function in miniunz.c in miniunzip in minizip before 1.1-5 might allow remote attackers to write to arbitrary files via a crafted entry in a ZIP archive...

China-Linked Hackers Target Myanmar's Top Ministries with Backdoor Blitz

The China-based threat actor known as Mustang Panda is suspected to have targeted Myanmar's Ministry of Defence and Foreign Affairs as part of twin campaigns designed to deploy backdoors and remote access trojans. The findings come from CSIRT-CTI, which said the activities took place in November...

python: tarfile module directory traversal

A flaw was found in the Python tarfile module. Extracting a crafted TAR archive with the tarfile.extract or tarfile.extractall functions could lead to a directory traversal vulnerability, resulting in overwrite of arbitrary files...

RHEL 8 : python-pip (RHSA-2024:0587)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0587 advisory. pip is a package management system used to install and manage software packages written in Python. Many packages can be found in the Python Package...

Fedora 39 : atril (2024-3914113f25)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-3914113f25 advisory. - update to 1.26.2 - fix security security advisory Tenable has extracted the preceding description block directly from the Fedora security advisory...

New CherryLoader Malware Mimics CherryTree to Deploy PrivEsc Exploits

A new Go-based malware loader called CherryLoader has been discovered by threat hunters in the wild to deliver additional payloads onto compromised hosts for follow-on exploitation. Arctic Wolf Labs, which discovered the new attack tool in two recent intrusions, said the loader's icon and name...

RHEL 8 : python-pip (RHSA-2024:0374)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0374 advisory. pip is a package management system used to install and manage software packages written in Python. Many packages can be found in the Python Package...

php: phar Buffer mismanagement

A flaw was found in PHP that can lead to a buffer overflow and a stack information leak due to improper bounds checking within the phardirread function. This issue may allow an attacker to initiate memory corruption by compelling the application to open a specially crafted .phar archive, allowing...