GHSA-8QCH-VJ6M-2694 luigi Arbitrary File Write via Archive Extraction (Zip Slip)

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper destination file path validation in the extractpackagesarchive function...

luigi Arbitrary File Write via Archive Extraction (Zip Slip)

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper destination file path validation in the extractpackagesarchive function...

CVE-2024-21542

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper destination file path validation in the extractpackagesarchive function...

PYSEC-2024-159

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper destination file path validation in the extractpackagesarchive function...

PYSEC-2024-159

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper destination file path validation in the extractpackagesarchive function...

CVE-2024-21542

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper destination file path validation in the extractpackagesarchive function...

CVE-2024-21542

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper destination file path validation in the extractpackagesarchive function...

CVE-2024-21542

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper destination file path validation in the extractpackagesarchive function...

CVE-2024-21542

CVE-2024-21542 affects luigi before 3.6.0, vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) caused by improper destination file path validation in the _extract_packages_archive function. A malicious zip can traverse paths to overwrite arbitrary files outside the target directo...

Directory Traversal

Overview preqs is an A simple and fast requirements.txt file generator. Affected versions of this package are vulnerable to Directory Traversal due to improper path sanitization in the ArgParser.sanitisepath method. An attacker could manipulate the PATH argument to traverse directories using ".."...

Directory Traversal

Overview libre-chat is a Free and Open Source Large Language Model LLM chatbot web UI and API. Self-hosted, offline capable and easy to setup. Powered by LangChain and Llama 2. Affected versions of this package are vulnerable to Directory Traversal through the uploaddocuments method. An attacker...

Security Bulletin: IBM SPSS Analytic Server has addressed multiple security vulnerabilities (CVE-2022-48285, CVE-2022-48285)

Summary IBM SPSS Analytic Server has addressed multiple security vulnerabilities CVE-2022-48285, CVE-2022-48285 Vulnerability Details CVEID:CVE-2022-48285 DESCRIPTION: JSZip could allow a remote attacker to traverse directories on the system, caused by the failure to sanitize filenames when files...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the asset upload functionality. An attacker can place files in unintended locations on the server by uploading files with specially crafted filenames. Details A Directory Traversal attack also known as path...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the IsDoneWithOutputToBaseDir method of the src/Zip.Shared/ZipEntry.Extract.cs component. This vulnerability derives from an incomplete fix of CVE-2018-1002205 Details A Directory Traversal attack also known ...

CLSA-2024-1731431756 kernel: Fix of 30 CVEs

tty: ngsm: Fix use-after-free in gsmcleanupmux CVE-2024-50073 - drm/amdkfd: amdkfdfreegttmem clear the correct pointer CVE-2024-49991 - ext4: fix timer use-after-free on failed mount CVE-2024-49960 - ext4: avoid use-after-free in ext4extshowleaf CVE-2024-49889 - ext4: fix slab-use-after-free in...

CLSA-2024-1731430561 kernel: Fix of 31 CVEs

driver core: bus: Fix double free in driver API busregister CVE-2024-50055 - net: tun: Fix use-after-free in tundetach CVE-2022-49014 - memcg: fix possible use-after-free in memcgwriteeventcontrol CVE-2022-48988 - ppp: fix pppasyncencode illegal access CVE-2024-50035 - drivers: media:...

slip: make slhc_remember() more robust against malicious packets

...

Directory Traversal

Overview changedetection.io is a Website change detection and monitoring service Affected versions of this package are vulnerable to Directory Traversal due to improper validation for the file URI scheme. An attacker can read any file on the system by crafting a URL that bypasses the intended...

Directory Traversal

Overview changedetection.io is a Website change detection and monitoring service Affected versions of this package are vulnerable to Directory Traversal via the Watch.py and init.py files, an attacker can read arbitrary files on the system by manipulating the file URL to bypass security checks...

Directory Traversal

Overview Werkzeug is a WSGI web application library. Affected versions of this package are vulnerable to Directory Traversal due to a bypass for os.path.isabs, which allows the improper handling of UNC paths beginning with /, in the safejoin function. This allows an attacker to read some files on...