10673 matches found
OESA-2022-2092 hadoop security update
Apache Hadoop is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models. It is designed to scale up from single servers to thousands of machines, each offering local computation and storage. Security Fixes: In Apache...
Microsoft Defender Experts for Hunting demonstrates industry-leading protection in the 2022 MITRE Engenuity ATT&CK® Evaluations for Managed Services
Microsoft Defender Experts for Hunting, our newest managed threat hunting service, delivered industry-leading results during the inaugural MITRE Engenuity ATT&CK® Evaluations for Managed Services. We provided a seamless, comprehensive, and rapid response to the simulated attack using expert-led...
php-pear: Directory traversal vulnerability
In ArchiveTar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193...
golang: compress/gzip: stack exhaustion in Reader.Read
A flaw was found in golang. Calling the Reader, Read method on an archive that contains a large number of concatenated 0-length compressed files can cause a panic issue due to stack exhaustion...
golang: compress/gzip: stack exhaustion in Reader.Read
A flaw was found in golang. Calling the Reader, Read method on an archive that contains a large number of concatenated 0-length compressed files can cause a panic issue due to stack exhaustion...
golang: compress/gzip: stack exhaustion in Reader.Read
A flaw was found in golang. Calling the Reader, Read method on an archive that contains a large number of concatenated 0-length compressed files can cause a panic issue due to stack exhaustion...
Apache Ivy does not verify target path when extracting the archive
With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to version 2.5.1 doesn't verify the target path when extracting the...
PT-2022-7284 · Apache +1 · Apache Ivy +1
Name of the Vulnerable Software and Affected Versions: Apache Ivy versions 2.4.0 through 2.5.0 Description: The issue is related to the extraction of archives in Apache Ivy, where the target path is not verified for artifacts using "zip", "jar", or "war" packaging. This allows an archive with...
Apache Ivy 路径遍历漏洞
Apache Ivy is a deliverable package manager from the Apache USA Foundation. A security vulnerability exists in Apache Ivy versions prior to 2.5.1 that stems from not validating the destination path when extracting archive files...
Apache UIMA 路径遍历漏洞
Apache UIMA is a component-based software architecture from the Apache Foundation. A path traversal vulnerability exists in Apache UIMA 3.3.0 and earlier, which stems from relative path traversal and can be exploited to create files outside of a specified destination directory using carefully...
Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked
ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...
Archive_Tar: improper filename sanitization leads to file overwrites
A flaw was found in the ArchiveTar package. PEAR ArchiveTar could allow a local authenticated attacker to bypass security restrictions caused by a stream-wrapper attack. An attacker can overwrite arbitrary files on the system using a specially-crafted tar archive...
EulerOS 2.0 SP10 : golang (EulerOS-SA-2022-2683)
According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request...
CVE-2022-41772
Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversal. This path traversal could result in remote code execution...
PT-2022-24934 · Qtiworks · Qtiworks
Name of the Vulnerable Software and Affected Versions: QTIWorks versions prior to 1.0-beta15 Description: QTIWorks is a software suite for standards-based assessment delivery. The ZIP handling code does not sufficiently check the paths of files contained within ZIP files, allowing files to be...
PT-2022-26063 · Delta Electronics · Infrasuite Device Master
Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions 00.00.01a and prior Description: The issue concerns the mishandling of .ZIP archives containing characters used in path traversal, which could result in remote code execution. This path...
Delta Electronics InfraSuite Device Master 路径遍历漏洞
Delta Electronics InfraSuite Device Master is used to simplify and automate the monitoring of critical equipment by Delta Electronics of Taiwan, China. A path traversal vulnerability exists in Delta Electronics InfraSuite Device Master 00.00.01a and prior versions, which stems from incorrectly...
Emotet Botnet Distributing Self-Unlocking Password-Protected RAR Files to Drop Malware
The notorious Emotet botnet has been linked to a new wave of malspam campaigns that take advantage of password-protected archive files to drop CoinMiner and Quasar RAT on compromised systems. In an attack chain detected by Trustwave SpiderLabs researchers, an invoice-themed ZIP file lure was foun...
The vulnerability of the image verification function in devices controlled by Cisco Expressway Series and Cisco Telepresence VCS allows a perpetrator to execute arbitrary code.
The vulnerability of the image verification function in devices controlled by Cisco Expressway Series and Cisco Telepresence VCS lies in the improper verification of the cryptographic signature. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by loading a maliciou...
