Arbitrary File Write via Archive Extraction (Zip Slip)

Overview org.jenkins-ci.plugins:fortify-cloudscan-jenkins-plugin allows an organization to host their own internal cloud-based infrastructure of Static Code Analyzer SCA machines that are distributed jobs by a centralized controller and optionally integrated with Software Security Center SSC...

BSA-2018-662

Security Advisory ID : BSA-2018-662 Component : Zip Slip Revision : 1.1: update Snyk Security team discloses a widespread arbitrary file overwrite critical vulnerability, which typically results in remote command execution. The flaw which has been named Zip Slip affects numerous archive-extractio...

CVE-2018-8009

Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file...

PT-2018-9622 · Apache +3 · Plexis Archiver +3

Name of the Vulnerable Software and Affected Versions: plexus-archiver versions prior to 3.6.0 Description: The issue allows attackers to write to arbitrary files via a ../ dot dot slash in an archive entry that is mishandled during extraction. This is also known as 'Zip-Slip'. Recommendations: F...

PT-2018-1388 · Quazip +1 · Quazip +1

Name of the Vulnerable Software and Affected Versions: QuaZIP versions prior to 0.7.6 Description: The issue allows attackers to perform directory traversal, enabling them to write to arbitrary files by including a ../ dot dot slash in a Zip archive entry. This is also known as 'Zip-Slip'. The...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview sharpziplib is a Zip, GZip, Tar and BZip2 library written entirely in C for the .NET platform. Affected versions of the package are vulnerable to Arbitrary File Write via Archive Extraction AKA "Zip Slip". It is exploited using a specially crafted zip archive, that holds path traversal...

Zip Slip Flaw Affects Thousands of Open-Source Projects

A known critical vulnerability has been given the moniker Zip Slip this week in an effort to raise awareness of its prevalence. A recent analysis shows the bug affects multiple open-source ecosystems, including JavaScript, Ruby, .NET and Go. As a result, thousands of developer projects, including...

CVE-2018-1002201

zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ dot dot slash in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'...

CVE-2018-1002202

zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ dot dot slash in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'...

Arbitrary File Write

SonarQube is vulnerable to zip-slip vulnerability. The vulnerability exists when the attacker inputs a malicious zip archive with filenames including file traversal characters such as dot dot .., leading to concatenation of file path locating outside of the destination folder...

Arbitrary File Write

Apache Hadoop Common is vulnerable to zip-slip vulnerability. The vulnerability exists when the attacker inputs a malicious zip archive with filenames including file traversal characters such as dot dot .., leading to concatenation of file path locating outside of the destination folder...

Arbitrary File Write

Plexus Archiver Component is vulnerable to zip-slip vulnerability. The vulnerability exists when the attacker inputs a malicious zip archive with filenames including file traversal characters such as dot dot .., leading to concatenation of file path locating outside of the destination folder...

Zip Slip Vulnerability

Challenge Veeam is aware of the Zip Slip Vulnerability, which affects jobs with the guest file system indexing option enabled. Zip Slip is an arbitrary file overwrite vulnerability in multiple ZIP decompression algorithm implementations that affects thousands of software products across many...

'Zip Slip' Vulnerability Affects Thousands of Projects Across Many Ecosystems

Security researchers at British software firm Snyk have revealed details of a critical vulnerability that affects thousands of projects across many ecosystems and can be exploited by attackers to achieve code execution on the target systems. Dubbed "Zip Slip," the issue is an arbitrary file...

Node.js third-party modules: Arbitrary File Write Through Archive Extraction

I would like to report arbitrary file write vulnerability in adm-zip module It allows attackers to write arbitrary files when a malicious archive is extracted. More info here: https://snyk.io/research/zip-slip-vulnerability https://github.com/snyk/zip-slip-vulnerabilityaffected-libraries Module...

Generic Zip Slip Traversal Vulnerability

This is a generic arbitrary file overwrite technique, which typically results in remote command execution. This targets a simple yet widespread vulnerability that has been seen affecting a variety of popular products including HP, Amazon, Apache, Cisco, etc. The idea is that often archive...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview org.springframework.integration:spring-integration-zip provides Zip un- compression support. Affected versions of the package are vulnerable to Arbitrary File Write via Archive Extraction AKA "Zip Slip". It is exploited using a specially crafted zip archive, that holds path traversal...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview org.springframework.integration:spring-integration-zip provides Zip un- compression support. Affected versions of the package are vulnerable to Arbitrary File Write via Archive Extraction AKA "Zip Slip". It is exploited using a specially crafted zip archive, that holds path traversal...

Unzip vulnerable to slip-zip attack

When extracting a ZIP file using the Unzip class, a prepared zip file could overwrite arbitrary files as the basedir wasn't enforced. All released versions starting with 1.0 are affected. The issue is addressed in release v1.8.1.6. You can modify earlier versions by implementing the changes from...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview org.apache.storm:storm-server is a distributed realtime computation system. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. Details It is exploited using a specially crafted zip archive, that holds path traversal filenames. When...