CVE-2018-1002208

SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ dot dot slash in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'...

CVE-2018-1002207

CVE-2018-1002207 affects the mholt/archiver Go package. The vulnerability stems from directory traversal in archive extraction ("../" path components), enabling an attacker to write to arbitrary files on the host. Affected: versions prior to the commit e4ef56d48eb029648b0e895bb0b6a393ef0829c3. Im...

CVE-2018-1002200

CVE-2018-1002200 affects plexus-archiver prior to 3.6.0, which is vulnerable to a directory traversal (Zip-Slip) that allows an attacker extracting a crafted archive to write to arbitrary files. Impact observed in multiple advisories: arbitrary file write/overwrite by exploiting zip entry path tr...

CVE-2018-1002205

CVE-2018-1002205 affects DotNetZip.Semvered before 1.11.0. It is a Zip-Slip directory traversal vulnerability where a crafted archive entry containing ../ can be mishandled during extraction, enabling writing to arbitrary files on the target system. Root cause is improper handling of pathnames du...

CVE-2018-1002209

QuaZIP before 0.7.6 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ dot dot slash in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'...

CVE-2018-1002208

SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ dot dot slash in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'...

CVE-2018-1002202

zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ dot dot slash in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'...

CVE-2018-1002200

plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ dot dot slash in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'...

CVE-2018-1002202

CVE-2018-1002202 concerns the zip4j Java library prior to 1.3.3, vulnerable to a directory traversal (Zip-Slip) when extracting a crafted Zip entry containing "..". This can allow writing to arbitrary files on the target system. Reported impact per sources indicates potential integrity impact (hi...

PT-2018-9625 · Hewlett Packard · Dotnetzip

Name of the Vulnerable Software and Affected Versions: DotNetZip.Semvered versions prior to 1.11.0 Description: The issue allows attackers to perform directory traversal, enabling them to write to arbitrary files. This is achieved by including a ../ dot dot slash in a Zip archive entry, which is...

PT-2018-9627 · Mholt · Archiver

Name of the Vulnerable Software and Affected Versions: mholt/archiver versions before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 Description: The issue allows attackers to write to arbitrary files via a ../ dot dot slash in an archive entry that is mishandled during extraction, also known as...

PT-2018-9626

Name of the Vulnerable Software and Affected Versions: SharpCompress versions prior to 0.21.0 Description: The issue allows attackers to write to arbitrary files via a ../ dot dot slash in a Zip archive entry that is mishandled during extraction. This is also known as 'Zip-Slip'. The vulnerabilit...

CVE-2018-1000623

JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" feature, available through the Admin menu - Import & Export - Repositories, triggers a vulnerable UI REST endpoint /ui/artifactimport/upload...

Directory traversal

JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" feature, available through the Admin menu - Import & Export - Repositories, triggers a vulnerable UI REST endpoint /ui/artifactimport/upload...

CVE-2018-1000623

JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" feature, available through the Admin menu - Import & Export - Repositories, triggers a vulnerable UI REST endpoint /ui/artifactimport/upload...

CVE-2018-1000623

CVE-2018-1000623 affects JFrog Artifactory: versions prior to 6.0.3 (since 4.0.0) contain a Directory Traversal vulnerability in the “Import Repository from Zip” UI path. The vulnerable endpoint is exposed at /ui/artifactimport/upload and, via a Zip Slip flaw, can lead to directory traversal, fil...

CVE-2018-1000623

JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" feature, available through the Admin menu - Import & Export - Repositories, triggers a vulnerable UI REST endpoint /ui/artifactimport/upload...

Arbitrary File Writing

DotNetZip.Semverd is vulnerable to arbitrary file writing aka zip-slip vulnerability. The vulnerability is possible because it does not check that the relative paths in a zip file don't go outside of the target directory...

Arbitrary File Writing

SharpZipLib is vulnerable to arbitrary file write aka zip slip vulnerability. It fails to check on the file path during extraction, allowing arbitrary files to be written outside of extraction directory...

Arbitrary File Write

SharpCompress is vulnerable to zip-slip vulnerability.The vulnerability exists due to the lack of check on the file path during extraction, allowing arbitrary files to be written in other directories...