SUSE CVE-2024-39133

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the zzipparserootdirectory function at /zzip/zip.c...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the zzipparserootdirectory function. An attacker can disrupt service and potentially execute arbitrary code by sending specially crafted inputs. Remediation A fix was pushed into the master branch but not...

AZL-43591 CVE-2024-39133 affecting package zziplib 0.13.72-3

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the zzipparserootdirectory function at /zzip/zip.c...

DEBIAN-CVE-2024-39133

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the zzipparserootdirectory function at /zzip/zip.c...

UBUNTU-CVE-2024-39133

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the zzipparserootdirectory function at /zzip/zip.c...

ZZIPlib security vulnerability

ZZIPlib is a compressed document extraction library. A security vulnerability exists in ZZIPlib version v0.13.77, which stems from a service resolution vulnerability in the zzipparserootdirectory function of the /zzip/zip.c file...

LoLLMs Security Vulnerabilities

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs version v9.6, which can be exploited to bypass protection by changing the root folder to /, allowing an attacker to read arbitrary files on the system...

CVE-2024-5018

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Path Traversal vulnerability exists Wug.UI.Areas.Wug.Controllers.SessionController.LoadNMScript. This allows allows reading of any file from the applications web-root directory...

CVE-2024-5018

Progress WhatsUp Gold contains a Path Traversal vulnerability (CVE-2024-5018) in the LoadNMScript path, affecting versions released before 2023.1.3. The issue resides in Wug.UI.Areas.Wug.Controllers.SessionController.LoadNMScript and allows reading files from the application's web-root without au...

CVE-2023-45197 Adminer and AdminerEvo vulnerable to directory traversal and file upload

The file upload plugin in Adminer and AdminerEvo allows an attacker to upload a file with a table name of “..” to the root of the Adminer directory. The attacker can effectively guess the name of the uploaded file and execute it. Adminer is no longer supported, but this issue was fixed in...

AdminerEvo Security Breach

AdminerEvo is an open source database management tool in a single PHP file from AdminerEvo. A security vulnerability exists in AdminerEvo that originates from allowing an attacker to upload a table name "..." file to the root of the Adminer directory. An attacker exploiting this vulnerability cou...

CVE-2024-5153 Startklar Elementor Addons <= 1.7.15 - Unauthenticated Path Traversal to Arbitrary Directory Deletion

The Startklar Elementor Addons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.15 via the 'dropzonehash' parameter. This makes it possible for unauthenticated attackers to copy the contents of arbitrary files on the server, which can contain...

PT-2024-34694

Name of the Vulnerable Software and Affected Versions Startklar Elementor Addons plugin for WordPress versions up to, and including, 1.7.15 Description The issue allows unauthenticated attackers to perform Directory Traversal via the dropzone hash parameter. This enables them to copy the contents...

TYPO3 Information Disclosure Vulnerability Exploitable by Editors

It has been discovered, that editors with access to the file list module could list all files names and folder names in the root directory of a TYPO3 installation. Modification of files, listing further nested directories or retrieving file contents was not possible. A valid backend user account ...

PT-2024-40443 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: A issue has been found that allows editors with access to the file list module to list all file names and folder names in the root directory of a TYPO3 installation. However, modification of...

PT-2024-23867 · Microsoft · Windows +3

Name of the Vulnerable Software and Affected Versions: Sunshine versions 0.17.0 through 0.22.2 Description: Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine as a service on Windows may be impacted when terminating the service if an attacker placed a file named...

CVE-2024-27945

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V5.5. The bulk import feature of the affected systems allow a privileged user to upload files to the root installation directory of the system. By replacing specific files, an attacker could tamper specific files or even achie...

CVE-2024-27944

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V5.5. The affected systems allow a privileged user to upload firmware files to the root installation directory of the system. By replacing specific files, an attacker could tamper specific files or even achieve remote code...

CVE-2024-27943

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V5.5. The affected systems allow a privileged user to upload generic files to the root installation directory of the system. By replacing specific files, an attacker could tamper specific files or even achieve remote code...

CVE-2024-27945

Affected product: Siemens RUGGEDCOM CROSSBOW. Vulnerability: External control of file name or path via the bulk import feature, enabling a privileged user to upload files to the root installation directory and potentially tamper files or achieve remote code execution. Root cause/vector: Bulk impo...