7563 matches found
CVE-2021-29425
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above thus "limited" path traversal,...
CVE-2021-29425
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above thus "limited" path traversal,...
CVE-2021-29425 Possible limited path traversal vulnerabily in Apache Commons IO
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above thus "limited" path traversal,...
CVE-2021-29425
CVE-2021-29425 affects Apache Commons IO up to version 2.6, specifically FileNameUtils.normalize. With inputs such as "//../foo" or "\..\foo", normalization can yield a value that does not escape to higher directories, potentially enabling access to the parent directory if the resulting path is u...
Directory Traversal
commons-io is vulnerable to Directory Traversal. Invoking the method FileNameUtils.normalize with a malicious input string would potentially allow access to files within the parent directory...
CVE-2021-29425: Improper Input Validation
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above thus "limited" path traversal,...
PT-2021-2689
Name of the Vulnerable Software and Affected Versions Apache Commons IO versions prior to 2.7 Description The issue is related to the FileNameUtils.normalize method in Apache Commons IO, which incorrectly handles directory traversal sequences such as "//../foo" or "..foo". This could allow a remo...
CVE-2021-29425
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above thus "limited" path traversal,...
CVE-2021-29425
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above thus "limited" path...
Apache Commons IO 路径遍历漏洞
Apache Commons IO is an application from the American Apache Foundation Apache Inc. It can help develop IO functionality. A path traversal vulnerability exists in Apache Commons IO versions 2.2 through 2.6. The vulnerability is related to the FileNameUtils.normalize method. An attacker can exploi...
PT-2022-2644 · Linux +5 · Linux Kernel +5
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to 5.4.189 Description: The issue is related to an integer overflow in the io uring interface of the Linux Kernel, which can be exploited by a local attacker to cause memory corruption and escalate privileges to th...
CVE-2021-28686
AsIO264.sys and AsIO232.sys in ASUS GPUTweak II before 2.3.0.3 allow low-privileged users to trigger a stack-based buffer overflow. This could enable low-privileged users to achieve Denial of Service via a DeviceIoControl...
Input validation
Memory corruption due to improper input validation while processing IO control which is nonstandard in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Wired Infrastructure and Networking...
CVE-2021-1892
Memory corruption due to improper input validation while processing IO control which is nonstandard in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Wired Infrastructure and Networking...
Denial Of Service (DoS)
jetty-io is vulnerable to denial of service. An attacker is able to send a large TLS frame with data length of more than 17408, resulting in high CPU consumption and a potential application crash...
CVE-2021-1892: Out-of-bounds Write
Memory corruption due to improper input validation while processing IO control which is nonstandard in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Wired Infrastructure and Networking...
PT-2021-13652
Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon affected versions not specified Description: The issue is related to memory corruption caused by improper input validation while processing nonstandard IO control in various Snapdragon components, including Compute,...
Hitachi Energy Relion 670, 650 and SAM600-IO
1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: Relion 670, 650, and SAM600-IO Vulnerabilities: Improper Input Validation 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled...
ffmpeg:ffmpeg_IO_DEMUXER_fuzzer: Crash in av_freep
Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6039826668322816 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegIODEMUXERfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7f2cd1c2479d Cra...
ffmpeg:ffmpeg_IO_DEMUXER_fuzzer: Heap-use-after-free in buffer_replace
Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4512973109460992 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegIODEMUXERfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address:...