10673 matches found
CVE-2022-31195 Path traversal vulnerability in Simple Archive Format package import in DSpace
DSpace open source software is a repository application which provides durable access to digital resources. In affected versions the ItemImportServiceImpl is vulnerable to a path traversal vulnerability. This means a malicious SAF simple archive format package could cause a file/directory to be...
golang: compress/gzip: stack exhaustion in Reader.Read
A flaw was found in golang. Calling the Reader, Read method on an archive that contains a large number of concatenated 0-length compressed files can cause a panic issue due to stack exhaustion...
DSpace 路径遍历漏洞
DSpace is an open source turnkey repository application from the DuraSpace community. A path traversal vulnerability exists in DSpace versions 4.0 through 6.3, which stems from the intention that the SAF Simple Archive Format package could lead to the creation of files/directories in any location...
[SECURITY] Fedora 36 Update: golang-github-vbatts-tar-split-0.11.1-11.fc36
Pristinely disassembling a tar archive, and stashing needed raw bytes and offsets to reassemble a validating original archive...
Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits
The Microsoft Threat Intelligence Center MSTIC and the Microsoft Security Response Center MSRC found a private-sector offensive actor PSOA using multiple Windows and Adobe 0-day exploits, including one for the recently patched CVE-2022-22047, in limited and targeted attacks against European and...
Command Injection
git-archive is vulnerable to command injection. A local authenticated attacker is able to inject and execute malicious commands through the exports function in index.js...
lambda_pattern (>=0.0.15, <=0.0.31), push2cloud-cli (>=1.0.0, <=2.0.3) +3 more potentially affected by CVE-2020-28422 via git-archive (0.1.4)
git-archive NPM version 0.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on git-archive and may be impacted: - lambdapattern =0.0.15, =1.0.0, =1.0.0, =2.0.4 - push2cloud-compiler-rf 2.0.2 Source cves: CVE-2020-28422 Source advisory:...
GHSA-VQGR-MFXM-47F3 git-archive vulnerable to Command Injection via exports function
All versions of package git-archive are vulnerable to Command Injection via the exports function...
git-archive vulnerable to Command Injection via exports function
All versions of package git-archive are vulnerable to Command Injection via the exports function...
CVE-2020-28422
All versions of package git-archive are vulnerable to Command Injection via the exports function...
Command injection
All versions of package git-archive are vulnerable to Command Injection via the exports function...
CVE-2020-28422 Command Injection
All versions of package git-archive are vulnerable to Command Injection via the exports function...
CVE-2020-28422
CVE-2020-28422 affects the git-archive module, where the vulnerability is a command injection via the exports function . All versions are reported vulnerable, enabling a local attacker to execute arbitrary commands through the exports function. The issue has been consistently described across mul...
git-archive 命令注入漏洞
git-archive is a module by Noah Isaacson, an individual developer, that takes a bare git repo, archives it, and exports it as a tarball to a given path. A security vulnerability exists in git-archive that stems from easy command injection via the exports function...
PT-2022-8885 · Unknown · Git-Archive
Name of the Vulnerable Software and Affected Versions: git-archive versions all Description: The issue concerns Command Injection via the exports function. This allows for potential execution of arbitrary commands. Recommendations: For all versions, consider disabling the exports function as a...
GO-2022-0524 Stack exhaustion when reading certain archives in compress/gzip
Calling Reader.Read on an archive containing a large number of concatenated 0-length compressed files can cause a panic due to stack exhaustion...
About the security content of Security Update 2022-005 Catalina
About the security content of Security Update 2022-005 Catalina This document describes the security content of Security Update 2022-005 Catalina. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has...
Fedora: Security Advisory for golang-github-mholt-archiver (FEDORA-2022-3969b64d4b)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Inductive Automation Ignition 代码问题漏洞
Inductive Automation Ignition is a suite of integrated software platforms for SCADA systems from Inductive Automation, Inc. The platform supports SCADA Data Acquisition and Monitoring Systems, HMI Human Machine Interface and more. A code issue vulnerability exists in Inductive Automation Ignition...