Design/Logic Flaw

mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using tarfile.extractall from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. Sometimes, the...

CVE-2023-28458

pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export a non-default feature. Organizers can trigger the overwriting with the standard pretalx 404 page content of an arbitrary file...

EUVD-2023-0205

pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export a non-default feature. Organizers can trigger the overwriting with the standard pretalx 404 page content of an arbitrary file...

Path traversal

pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export a non-default feature. Organizers can trigger the overwriting with the standard pretalx 404 page content of an arbitrary file...

CVE-2023-28458

pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export a non-default feature. Organizers can trigger the overwriting with the standard pretalx 404 page content of an arbitrary file...

CVE-2023-28458

CVE-2023-28458 affects Pretalx up to version 2.3.1, where path traversal in the HTML export feature can allow overwriting an arbitrary file with the standard 404 page content. The vulnerability is documented with multiple sources confirming a limited file-write condition that can lead to a broade...

CVE-2023-28458

pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export a non-default feature. Organizers can trigger the overwriting with the standard pretalx 404 page content of an arbitrary file...

PT-2023-3152 · Cisco · Cisco Telepresence Ce +1

Name of the Vulnerable Software and Affected Versions: Cisco TelePresence CE and RoomOS versions affected versions not specified Description: The issue is related to improper access controls on files in the local file system, allowing an authenticated, local attacker to overwrite arbitrary files...

CVE-2023-29465

SageMath FlintQS 1.0 relies on pathnames under TMPDIR typically world-writable, which for example allows a local user to overwrite files with the privileges of a different user who is running FlintQS...

PT-2023-22817 · Mindsdb +1 · Mindsdb +1

Name of the Vulnerable Software and Affected Versions: mindsdb versions prior to 23.2.1.0 Description: The issue is related to an unsafe extraction performed using tarfile.extractall from a remotely retrieved tarball, which may lead to the writing of extracted files to an unintended location. Thi...

PYSEC-2023-51

ubireaderextractfiles is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of the extraction directory provided the process has write access to that file or directory. This is due to the fact that a node name...

CVE-2023-0591 Path Traversal in ubi_reader

ubireaderextractfiles is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of the extraction directory provided the process has write access to that file or directory. This is due to the fact that a node name...

CVE-2023-0242 Insufficient permission check in the VQL copy() function

Rapid7 Velociraptor allows users to be created with different privileges on the server. Administrators are generally allowed to run any command on the server including writing arbitrary files. However, lower privilege users are generally forbidden from writing or modifying files on the server. Th...

GHSA-F5C5-HMW9-V8HX Unzip vulnerable to path traversal

Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

CVE-2018-25046

Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

Input validation

Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

CVE-2018-25046 Path traversal in code.cloudfoundry.org/archiver

Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

SUSE-SU-2022:4349-1 Security update for buildah

This update for buildah fixes the following issues: Version update to 1.28.2. - CVE-2022-2990: Fixed a possible information disclosure and modification vulnerability bsc1202812. - CVE-2020-10696: Fixed an issue with a crafted input tar file that may lead to a local file overwriting during image...

Directory traversal

A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. This vulnerability is also known as 'Zip-Slip'. An attacker can create a KNIME workflow that, when being uploaded, ca...

CVE-2022-44748 Uploading workflows to KNIME Server may override arbitrary file system contents

A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. This vulnerability is also known as 'Zip-Slip'. An attacker can create a KNIME workflow that, when being uploaded, ca...