9720 matches found
SUSE CVE-2024-8088
There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive for example, methods of "zipfile.Path" like "namelist", "iterdir", etc...
Arbitrary File Write via Archive Extraction (Zip Slip)
Overview luigi is a package that helps you build complex pipelines of batch jobs. It handles dependency resolution, workflow management, visualization, handling failures, command line integration, and much more. Affected versions of this package are vulnerable to Arbitrary File Write via Archive...
PT-2024-9332 · Luigi · Luigi
Name of the Vulnerable Software and Affected Versions: luigi versions prior to 3.6.0 Description: The issue is related to improper destination file path validation in the extract packages archive function, which can lead to arbitrary file write via archive extraction, also known as Zip Slip. This...
CVE-2024-42364
CVE-2024-42364 – DNS rebinding vulnerability in Homepage 0.9.1. The default, unauthenticated setup of Homepage (0.9.1) can be abused via DNS rebinding to route requests to the internal IP of the Homepage instance, allowing an attacker-controlled site to access sensitive data (e.g., API keys) due ...
DEBIAN-CVE-2024-8088
There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive for example, methods of "zipfile.Path" like "namelist", "iterdir", etc...
UBUNTU-CVE-2024-8088
There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive for example, methods of "zipfile.Path" like "namelist", "iterdir", etc...
PT-2024-6043 · Python +12 · Cpython +12
Name of the Vulnerable Software and Affected Versions: CPython affected versions not specified Description: There is a HIGH severity issue affecting the CPython "zipfile" module, specifically the "zipfile.Path" class, which can cause an infinite loop when iterating over names of entries in a...
GO-2022-0805 github.com/u-root/u-root/pkg/tarutil Arbitrary File Write via Archive Extraction (Zip Slip) in github.com/u-root/u-root
github.com/u-root/u-root/pkg/tarutil Arbitrary File Write via Archive Extraction Zip Slip in github.com/u-root/u-root...
GO-2022-0799 Arbitrary File Write via Archive Extraction in mholt/archiver in github.com/mholt/archiver
Arbitrary File Write via Archive Extraction in mholt/archiver in github.com/mholt/archiver...
GO-2023-2071 Sender can cause a receiver to overwrite files during ZIP extraction in Croc in github.com/schollz/croc
Sender can cause a receiver to overwrite files during ZIP extraction in Croc in github.com/schollz/croc...
CVE-2024-7651
The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to limited SQL Injection via the ‘app-builder-search’ parameter in all versions up to, and including, 4.2.6 due to insufficient escaping on the user supplied parameter and lack of sufficient...
EulerOS Virtualization 2.11.0 : less (EulerOS-SA-2024-2180)
According to the versions of the less package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename....
Zip Slip
mobsf is vulnerable to Zip Slip. The vulnerability is caused due to a missing validation while extracting .a extension files. This allows an attacker to extract files to any desired location within the server running MobS...
Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files
Summary Upon reviewing the MobSF source code, I identified a flaw in the Static Libraries analysis section. Specifically, during the extraction of .a extension files, the measure intended to prevent Zip Slip attacks is improperly implemented. Since the implemented measure can be bypassed, the...
GHSA-4HH3-VJ32-GR6J Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files
Summary Upon reviewing the MobSF source code, I identified a flaw in the Static Libraries analysis section. Specifically, during the extraction of .a extension files, the measure intended to prevent Zip Slip attacks is improperly implemented. Since the implemented measure can be bypassed, the...
SUSE-SU-2024:2961-1 Security update for osc
This update for osc fixes the following issues: - 1.9.0 - Security: - Fix possibility to overwrite special files in .osc CVE-2024-22034 bsc1225911 Source files are now stored in the 'sources' subdirectory which prevents name collisons. This requires changing version of '.osc' store to 2.0. -...
CVE-2024-25582
Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform malicious API requests or extract information from the users account. Exploiting this vulnerability requires temporary access to an account or successful social...
PT-2024-6093
Name of the Vulnerable Software and Affected Versions HashiCorp Nomad versions 0.6.1 through 1.6.13 HashiCorp Nomad versions 1.7.0 through 1.7.10 HashiCorp Nomad versions 1.8.0 through 1.8.2 Description The archive unpacking process in HashiCorp Nomad is vulnerable to writes outside the allocatio...
CVE-2024-21981
Improper key usage control in AMD Secure Processor ASP may allow an attacker with local access who has gained arbitrary code execution privilege in ASP to extract ASP cryptographic keys, potentially resulting in loss of confidentiality and integrity...
