SUSE CVE-2015-1191

Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a 1 full pathname or 2 .. dot dot in an archive...

SUSE CVE-2015-5305

Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd...

SUSE CVE-2017-16544

In the addmatch function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code...

SUSE CVE-2018-1000079

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to...

SUSE CVE-2018-1002209

QuaZIP before 0.7.6 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ dot dot slash in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'...

SUSE CVE-2019-10185

It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break o...

SUSE CVE-2021-32557

It was discovered that the processreport function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks...

PT-2023-16497 · Yugabyte · Yugabytedb

Name of the Vulnerable Software and Affected Versions: YugabyteDB Anywhere versions 2.0.0.0 through 2.13.0.0 Description: The High Availability functionality of Yugabyte Anywhere can be exploited to write arbitrary files through the backup upload endpoint by using path traversal characters. This...

EulerOS 2.0 SP8 : device-mapper-multipath (EulerOS-SA-2023-1310)

According to the versions of the device-mapper-multipath packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with...

ASUS RT-AC68U 安全漏洞

ASUS RT-AC68U is a router from Asus China. A security vulnerability exists in ASUS RT-AC68U router firmware versions prior to 3.0.0.4.386.41634, which stems from incorrect access control. An attacker can exploit the vulnerability to write arbitrary files to perform COPY and MOVE operations...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal due to improper input sanitization of the path being requested via the requestFile function. PoC curl --path-as-is "http://localhost:3000/../package.json Details A Directory Traversal attack also known as path...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal due to improper sanitization of the filePath variable. PoC curl --path-as-is "http://localhost:3000/../public-isprivate/index.html" Details A Directory Traversal attack also known as path traversal aims to access fil...

Arbitrary File Write

libziparchive.so is vulnerable to arbitrary file writes. The vulnerability exists due to lack of sanitization on paths which allows an attacker to overwrite files on the file system when opening a malicious ZIP with symlink...

EulerOS 2.0 SP11 : multipath-tools (EulerOS-SA-2023-1042)

According to the versions of the multipath-tools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with...

EulerOS 2.0 SP11 : multipath-tools (EulerOS-SA-2023-1017)

According to the versions of the multipath-tools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with...

SSZipArchive 后置链接漏洞

SSZipArchive is ZipArchive open source a simple utility class . It is used to compress and uncompress files on iOS, macOS and tvOS. A security vulnerability exists in SSZipArchive 2.5.3 and prior versions, which stems from its lack of sanitization of symbolic link paths causing SSZipArchive to...

PT-2025-37900

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel where the file length of an inline file was incorrectly updated even when a write operation failed or only partially succeeded. This occurred because th...

Fedora 36 : device-mapper-multipath (2022-6ec78b2586)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-6ec78b2586 advisory. Security fix for CVE-2022-41973 and CVE-2022-41974 Tenable has extracted the preceding description block directly from the Fedora security advisory...

GuardDog 路径遍历漏洞

GuardDog is GuardDog open source a CLI tool that allows to identify malicious PyPI packages. A path traversal vulnerability exists in GuardDog versions prior to v0.1.8, which stems from the vulnerability to arbitrary file writes when scanning specially crafted remote PyPI packages, and the use of...

UBUNTU-CVE-2022-44900

A directory traversal vulnerability in the SevenZipFile.extractall function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file...