STVS ProVision 5.9.10 File Disclosure

STVS ProVision 5.9.10 archive.rb Authenticated File Disclosure Vulnerability Vendor: STVS SA Product web page: http://www.stvs.ch Platform: Ruby Affected version: 5.9.10 build 2885-3a8219a 5.9.9 build 2882-7c3b787 5.9.7 build 2871-a450938 5.9.1 build 2771-1bbed11 5.9.0 build 2701-6123026 5.8.6...

Directory Traversal

kubernetes client-java is vulnerable to directory traversal. Lack of validation in the copyDirectoryFromPod allows arbitrary writes to files outside of the current directory through a malicious archive...

CVE-2020-8570

Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process...

CVE-2020-8570 Kubernetes Java client libraries unvalidated path traversal in Copy implementation

Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process...

PT-2021-12794 · Unknown · Kubernetes Java Client Libraries

Name of the Vulnerable Software and Affected Versions: Kubernetes Java client libraries versions prior to 9.0.1 Kubernetes Java client libraries version 10.0.0 Description: The issue allows writes to paths outside of the current directory when copying multiple files from a remote pod that sends a...

Design/Logic Flaw

A vulnerability in the configuration archive functionality of Cisco DNA Center could allow any privilege-level authenticated, remote attacker to obtain the full unmasked running configuration of managed devices. The vulnerability is due to the configuration archives files being stored in clear...

CVE-2021-1265 Cisco DNA Center Information Disclosure Vulnerability

A vulnerability in the configuration archive functionality of Cisco DNA Center could allow any privilege-level authenticated, remote attacker to obtain the full unmasked running configuration of managed devices. The vulnerability is due to the configuration archives files being stored in clear...

DRUPAL-CORE-2021-001

The Drupal project uses the pear Archive\Tar library, which has released a security update that impacts Drupal. For more information please see: CVE-2020-36193 Exploits may be possible if Drupal is configured to allow .tar, .tar.gz, .bz2, or .tlz file uploads and processes them...

Cisco DNA Center Information Disclosure Vulnerability

A vulnerability in the configuration archive functionality of Cisco DNA Center could allow any privilege-level authenticated, remote attacker to obtain the full unmasked running configuration of managed devices. The vulnerability is due to the configuration archives files being stored in clear...

PT-2021-1811 · Cisco · Cisco Dna Center

Name of the Vulnerable Software and Affected Versions: Cisco DNA Center affected versions not specified Description: The issue is related to the configuration archive functionality, where confidential information is stored unencrypted. This could allow a remote attacker to gain unauthorized acces...

UBUNTU-CVE-2020-36193

Tar.php in ArchiveTar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948...

CVE-2020-36193

Tar.php in ArchiveTar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948...

Pear Archive_Tar Backlink Vulnerability

Pear ArchiveTar is a Php-based software from the Pear PEAR team that allows for the creation, extraction, etc. of tarballs. ArchiveTar through 1.4.11 suffers from a backlink vulnerability that allows write operations via directory traversal...

CVE-2021-21251

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3 there is a critical "zip slip" vulnerability. This issue may lead to arbitrary file write. The KubernetesResource REST endpoint untars user controlled data from the request body using TarUtils. TarUtils is a custom library...

Researchers Disclose Undocumented Chinese Malware Used in Recent Attacks

Cybersecurity researchers have disclosed a series of attacks by a threat actor of Chinese origin that has targeted organizations in Russia and Hong Kong with malware — including a previously undocumented backdoor. Attributing the campaign to Winnti or APT41, Positive Technologies dated the first...

Researchers Disclose Undocumented Chinese Malware Used in Recent Attacks

Cybersecurity researchers have disclosed a series of attacks by a threat actor of Chinese origin that has targeted organizations in Russia and Hong Kong with malware — including a previously undocumented backdoor. Attributing the campaign to Winnti or APT41, Positive Technologies dated the first...

OSV-2017-117 Use-of-uninitialized-value in CharToWide

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4290 Crash type: Use-of-uninitialized-value Crash state: CharToWide Archive::GetComment Archive::ViewComment...

OSV-2017-100 Use-of-uninitialized-value in Archive::ConvertAttributes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4272 Crash type: Use-of-uninitialized-value Crash state: Archive::ConvertAttributes CmdExtract::ExtractCurrentFile CmdExtract::ExtractArchive...

OSV-2017-95 Use-of-uninitialized-value in Archive::GetComment

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4410 Crash type: Use-of-uninitialized-value Crash state: Archive::GetComment Archive::ViewComment CmdExtract::ExtractArchive...

OSV-2017-76 Use-of-uninitialized-value in Archive::ConvertFileHeader

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4279 Crash type: Use-of-uninitialized-value Crash state: Archive::ConvertFileHeader Archive::ReadHeader15 Archive::ReadHeader...