nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite

The npm package "tar" aka node-tar has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted...

nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite

The npm package "tar" aka node-tar has an arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This i...

GHSA-729F-WVJ3-C4PJ Remote code execution in UReport

An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code...

Remote code execution in UReport

An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code...

GHSA-JP7F-GRCV-6MJF Partial path traversal in sharpcompress

SharpCompress recreates a hierarchy of directories under destinationDirectory if ExtractFullPath is set to true in options. In order to prevent extraction outside the destination directory the destinationFileName path is verified to begin with fullDestinationDirectoryPath. However it is not...

Partial path traversal in sharpcompress

SharpCompress recreates a hierarchy of directories under destinationDirectory if ExtractFullPath is set to true in options. In order to prevent extraction outside the destination directory the destinationFileName path is verified to begin with fullDestinationDirectoryPath. However it is not...

SolarWinds Orion Platform NCM VulnerabilitySettings Directory Traversal Arbitrary File Creation Vulnerability

This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within...

CVE-2021-39208

SharpCompress is a fully managed C library to deal with many compression types and formats. Versions prior to 0.29.0 are vulnerable to partial path traversal. SharpCompress recreates a hierarchy of directories under destinationDirectory if ExtractFullPath is set to true in options. In order to...

Path traversal

SharpCompress is a fully managed C library to deal with many compression types and formats. Versions prior to 0.29.0 are vulnerable to partial path traversal. SharpCompress recreates a hierarchy of directories under destinationDirectory if ExtractFullPath is set to true in options. In order to...

CVE-2021-39208 WriteEntryToDirectory used for an archive extraction is vulnerable to partial path traversal.

SharpCompress is a fully managed C library to deal with many compression types and formats. Versions prior to 0.29.0 are vulnerable to partial path traversal. SharpCompress recreates a hierarchy of directories under destinationDirectory if ExtractFullPath is set to true in options. In order to...

NETGEAR 注入漏洞

Netgear NETGEAR is a router from Netgear, Inc. A hardware device that connects two or more networks and acts as a gateway between networks. A variety of NETGEAR switches are vulnerable to an authorization issue, which stems from a password field in the product's Web UI that fails to properly hand...

UReport Arbitrary File Creation Vulnerability

UReport is a high-performance pure Java reporting engine based on the Spring architecture. ureport version 2.2.9 contains an arbitrary file creation vulnerability. An attacker can exploit this vulnerability to execute arbitrary code...

CVE-2020-21125

An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code...

CVE-2020-21125

An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code...

Design/Logic Flaw

An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code...

CVE-2020-21125

CVE-2020-21125 corresponds to an arbitrary file creation vulnerability in UReport 2.2.9. The connected documents consistently describe this as a vulnerability in a Java-based reporting engine that could permit an attacker to cause arbitrary code execution through file creation. The affected produ...

UReport 代码注入漏洞

UReport is a high-performance pure Java reporting engine based on the Spring architecture. ureport version 2.2.9 contains an arbitrary file creation vulnerability. An attacker can exploit this vulnerability to execute arbitrary code...

Adobe Digital Editions 安全漏洞

Adobe Digital Editions software provides an engaging way to help you view and manage eBooks and other digital publications. Adobe Digital Editions 4.5.11.187646 and earlier versions are vulnerable to an arbitrary file system write vulnerability. The vulnerability stems from the creation of...

Huawei HarmonyOS 路径遍历漏洞

Huawei HarmonyOS is an operating system from Huawei, a Chinese company that provides a microkernel-based distributed operating system. A directory traversal vulnerability exists in the Applications module of Huawei HarmonyOS version 2.0, which provides a microkernel-based, full-scenario distribut...

Design/Logic Flaw

Adobe Captivate version 11.5.5 and earlier is affected by an Creation of Temporary File In Directory With Incorrect Permissions vulnerability that could result in privilege escalation in the context of the current user. The attacker must plant a malicious file in a particular location of the...