CVE-2023-38346

Wind River VxWorks 6.9 and 7 are affected by CVE-2023-38346 due to the tarExtract function handling TAR archives without proper path validation, which may allow directory traversal and unintended behavior. The issue arises from tarExtract processing files with relative or absolute paths and not c...

CVE-2023-38346

An issue was discovered in Wind River VxWorks 6.9 and 7. The function tarExtract implements TAR file extraction and thereby also processes files within an archive that have relative or absolute file paths. A developer using the "tarExtract" function may expect that the function will strip leading...

CVE-2023-42806

Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, not signing and verifying $\mathsfcid$ allows an attacker which must be a participant of this head to use a snapshot from an old head instance with the same participants to close the head or contest the state with i...

CVE-2023-42806 Snapshot signature not including HeadID will allow replay attacks

Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, not signing and verifying $\mathsfcid$ allows an attacker which must be a participant of this head to use a snapshot from an old head instance with the same participants to close the head or contest the state with i...

CVE-2023-42806 Snapshot signature not including HeadID will allow replay attacks

Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, not signing and verifying $\mathsfcid$ allows an attacker which must be a participant of this head to use a snapshot from an old head instance with the same participants to close the head or contest the state with i...

CVE-2023-42806

Hydra (Cardano) prior to v0.13.0 has a vulnerability where not signing/verifying the cid allows a participant to reuse a snapshot from an old head to close the head or contest state with the same participants. This can cause incorrect value distribution (value extraction) or prevent finalization ...

CVE-2023-4760 Remote Code Execution in Eclipse RAP on Windows

In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component. The reason for this is a not completely secure extraction of the file name in the FileUploadProcessor.stripFileNameString name method. As soon as this...

CVE-2023-4760 Remote Code Execution in Eclipse RAP on Windows

In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component. The reason for this is a not completely secure extraction of the file name in the FileUploadProcessor.stripFileNameString name method. As soon as this...

PT-2023-5467

Name of the Vulnerable Software and Affected Versions Ansible affected versions not specified Description A path traversal issue exists when Ansible extracts tarballs, allowing an attacker to craft a malicious tarball. This could result in a symlink being dropped on the disk when using the galaxy...

SUSE CVE-2023-43616

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...

GHSA-8C8W-F7WP-2JR2 Sender can cause a receiver to overwrite files during ZIP extraction in Croc

An issue was discovered in Croc before 9.6.16. A sender can cause a receiver to overwrite files during ZIP extraction...

Sender can cause a receiver to overwrite files during ZIP extraction in Croc

An issue was discovered in Croc before 9.6.16. A sender can cause a receiver to overwrite files during ZIP extraction...

CVE-2023-43616

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...

Code injection

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...

CVE-2023-43616

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...

croc path traversal vulnerability

croc is a tool from the individual developers at Zack that allows any two computers to simply and securely transfer files and folders. A path traversal vulnerability exists in Croc version 9.6.5 and prior versions, which originates from a sender that can cause the receiver to overwrite files duri...

CVE-2023-43616

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...

CVE-2023-43616

CVE-2023-43616 affects Croc through version 9.6.5; a sender can cause the receiver to overwrite files during ZIP extraction due to the ZIP extraction handling. Impact is local and relates to file overwrites during extraction. The provided documents do not specify a fixed version or a remediation,...

Sql injection

A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain parameters used in the Query functionality, allows an authenticated attacker to execute arbitrary SQL queries on the DBMS used by the web application. Authenticated users can extract...

PT-2023-28877 · Croc · Croc

Name of the Vulnerable Software and Affected Versions: Croc versions through 9.6.5 Description: An issue was discovered in Croc where a sender can cause a receiver to overwrite files during ZIP extraction. Recommendations: For versions through 9.6.5, update to a version newer than 9.6.5 to resolv...