10249 matches found
The vulnerability of the `make_archive` function in the `shutil` module of the Python programming language interpreter (CPython) allows a malicious actor to trigger a service failure or gain unauthorized access to information.
The vulnerability of the makearchive function in the shutil module of the Python programming language interpreter CPython is related to errors in user input filtering. Exploiting this vulnerability could allow an attacker to cause service failures or gain unauthorized access to protected...
CVE-2019-1000009
Helm ChartMuseum version =0.1.0 and 0.8.1 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in HTTP API to save charts that can result in a specially crafted chart could be uploaded and saved outside the intended location. This attack...
Electronegativity - Tool To Identify Misconfigurations And Security Anti-Patterns In Electron Applications
Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications. It leverages AST and DOM parsing to look for security-relevant configurations, as described in the "Electron Security Checklist - A Guide for Developers and Auditors" whitepaper...
Product update: Virtuozzo Infrastructure Platform 2.5 Update 2 (2.5.0-1600)
This update provides a stability and usability fix. Vulnerability id: VSTOR-20151 Some storage cluster archives may become unavailable after upgrade to version 2.5...
Directory traversal
An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via app=/../ to begin the process of creating a ZIP archive file with the complete contents of any directory because of an apps.admincp.php error. This ZIP archive file can then be downloade...
CVE-2019-7234
An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via app=/../ to begin the process of creating a ZIP archive file with the complete contents of any directory because of an apps.admincp.php error. This ZIP archive file can then be downloade...
CVE-2019-7234
An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via app=/../ to begin the process of creating a ZIP archive file with the complete contents of any directory because of an apps.admincp.php error. This ZIP archive file can then be downloade...
CVE-2019-7234
The CVE-2019-7234 entry affects idreamsoft iCMS 7.0.13. The vulnerability stems from an error in admincp.php?app=apps&do=save (via _app=/../ in apps.admincp.php) that enables directory traversal, permitting creation of a ZIP archive containing contents of an arbitrary directory, which can then be...
CVE-2019-7234
An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via app=/../ to begin the process of creating a ZIP archive file with the complete contents of any directory because of an apps.admincp.php error. This ZIP archive file can then be downloade...
BEWARD Intercom 2.3.1 Credential Disclosure
!/usr/bin/env python -- coding: utf8 -- BEWARD Intercom 2.3.1 Credentials Disclosure Vendor: Beward R&D Co., Ltd Product web page: https://www.beward.net Affected version: 2.3.1.34471 2.3.0 2.2.11 2.2.10.5 2.2.9 2.2.8.9 2.2.7.4 Note: For versions above 2.2.11: The application data directory, whic...
BEWARD Intercom 2.3.1 - Credentials Disclosure
!/usr/bin/env python -- coding: utf8 -- BEWARD Intercom 2.3.1 Credentials Disclosure Vendor: Beward R&D Co., Ltd Product web page: https://www.beward.net Affected version: 2.3.1.34471 2.3.0 2.2.11 2.2.10.5 2.2.9 2.2.8.9 2.2.7.4 Note: For versions above 2.2.11: The application data directory, whic...
Cisco Webex Network Recording Player and Webex Player for Windows Buffer Overflow Vulnerability (CNVD-2019-02788)
Cisco Webex Business Suite WBS32 sites, etc. are video conferencing solutions from Cisco USA.Cisco Webex Network Recording Player and Webex Player are among the players used to play video conference recordings. A buffer overflow vulnerability exists in the Windows-based Cisco Webex Network...
Redaman Spams Russian Banking Customers with Rotating Tactics
The Redaman banking trojan ramped up its activity in the last part of 2018, employing ongoing back-end changes in order to evade detection, according to a new Wednesday report. Redaman as a malware first came on the scene in 2015, and since then has consistently targeted victims that use Russian...
DRUPAL-CORE-2019-001
Drupal core uses the third-party PEAR Archive\Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details...
Arbitrary File Write
Plexus Archiver Component is vulnerable to zip-slip vulnerability. The vulnerability exists when the attacker inputs a malicious zip archive with filenames including file traversal characters such as dot dot .., leading to concatenation of file path locating outside of the destination folder...
Denial Of Service
PHP is vulnerable to denial of service DoS. When attacker inputs a malicious length value along with malicious PHP's Phar extension parsed Phar archive, it causes the application to crash when the file is opened...
Directory Traversal
openjdk is vulnerable to directory traversal. A remote attacker is able to create or overwrite arbitrary files on the system using a malicious JAR archive containing files with ../ characters. The malicious file operations will be performed when the JAR archive is extracted...
USN-3857-1 php-pear vulnerability
Fariskhi Vidyan discovered that PEAR ArchiveTar incorrectly handled certain archive paths. A remote attacker could possibly use this issue to execute arbitrary code...
ARC Path Traversal Vulnerability
ARC is a software package for creating and maintaining file archives. A directory traversal vulnerability exists in ARC version 5.21q. No details of the vulnerability are provided at this time...