CVE-2026-82635

Pake before 3.13.1 joins the JavaScript-supplied filename for the downloadfile Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences for example ../Library/LaunchAgents/com.evil.plist or an absolute path resolves outside /Downloads...

CVE-2026-82635

Pake before 3.13.1 is vulnerable to arbitrary file write via its download_file Tauri command. The JavaScript-supplied filename is joined onto the user's Downloads directory without sanitization, so a filename containing path traversal sequences or an absolute path resolves outside ~/Downloads. Th...

CVE-2026-82635 Pake arbitrary file write via unsanitized download_file filename

Pake before 3.13.1 joins the JavaScript-supplied filename for the downloadfile Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences for example ../Library/LaunchAgents/com.evil.plist or an absolute path resolves outside /Downloads...

EUVD-2026-68199

Pake before 3.13.1 joins the JavaScript-supplied filename for the downloadfile Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences for example ../Library/LaunchAgents/com.evil.plist or an absolute path resolves outside /Downloads...

CVE-2026-82635 Pake arbitrary file write via unsanitized download_file filename

Pake before 3.13.1 joins the JavaScript-supplied filename for the downloadfile Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences for example ../Library/LaunchAgents/com.evil.plist or an absolute path resolves outside /Downloads...

PT-2026-83555

Name of the Vulnerable Software and Affected Versions Pake versions prior to 3.13.1 Description The download file Tauri command fails to sanitize the JavaScript-supplied filename before joining it to the user's Downloads directory. This allows a filename containing an absolute path or path...

EUVD-2010-4446

Malware in sbrugna...

EUVD-2010-4225

Malware in sbrugna...

EUVD-2014-1766

Malware in sbrugna...

pake-cli (>=2.0.7-beta1, <=2.0.7), vue-cli-plugin-tauri (>=1.0.0-beta-rc.1, <=1.0.0-rc.3) potentially affected by CVE-2023-46115 via @tauri-apps/cli (>=1.0.0-beta-rc.1, <=1.3.1)

@tauri-apps/cli NPM version =1.0.0-beta-rc.1, =2.0.7-beta1, =1.0.0-beta-rc.1, =1.0.0-rc.3 Source cves: CVE-2023-46115 Source advisory: OSV:GHSA-2RCP-JVR4-R259...

K15504: OpenSSH vulnerability CVE-2014-1692

Security Advisory Description The hashbuffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service memory corruption or have unspecifie...

K17382: OpenSSL vulnerability CVE-2010-4252

Security Advisory Description OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in ea...

K14317: OpenSSH J-PAKE vulnerability CVE-2010-4478

OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate. F5 products do not include J-PAKE in the OpenSSH programs a...

BSA-2017-246

Security Advisory ID : BSA-2017-246 Component : FOS Revision : 2.0: Final Thehashbufferfunction inschnorr.cinOpenSSHthrough 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of servic...

OpenSSH 'schnorr.c' Remote Memory Corruption Vulnerability

OpenSSH is prone to a remote memory-corruption vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openbsd:openssh";...

OpenSSH 'schnorr.c'远程内存破坏漏洞

BUGTRAQ ID: 65230 CVECAN ID: CVE-2014-1692 OpenSSH是SSH协议的开源实现。 OpenSSH 6.4版本及之前版本，如果Makefile.inc修改为启用J-PAKE协议，schnorr.c内的hashbuffer函数就不会初始化某些数据结构，这可使远程攻击者造成拒绝服务（内存破坏）。 0 OpenSSH OpenSSH 6.4 厂商补丁： OpenSSH ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.openssh.com/...

CVE-2014-1692

The hashbuffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service memory corruption or have unspecified other impact via vectors tha...

Design/Logic Flaw

The hashbuffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service memory corruption or have unspecified other impact via vectors tha...

CVE-2014-1692

The hashbuffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service memory corruption or have unspecified other impact via vectors tha...

CVE-2014-1692

The hashbuffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service memory corruption or have unspecified other impact via vectors tha...