Directory Traversal

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Directory Traversal via the process handling file paths. A low-privileged attacker can access sensitive files outside the intended directory by submitting crafted path...

SUSE SLED15: mockito / mockito-javadoc / snakeyaml / snakeyaml-javadoc / testng / etc (SUSE-SU-2024:2568-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2568-1 advisory. mockito was updated to version 5.11.0: - Added bundle manifest to the mockito-core artifact - Mockito 5 i...

Directory Traversal

Overview Csla is a software development framework that helps you build a reusable, maintainable object-oriented business layer for your app. Affected versions of this package are vulnerable to Directory Traversal through the MobileFormatter component. An attacker can execute arbitrary code by...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip via the parseFromZipFile function, which will copy the file in zip to a temporary directory without verifying the file path, and the file can be written to an arbitrary path. Details ...

BIT-OPENCART-2024-21515

This affects versions of the package opencart/opencart from 4.0.0-0. A reflected XSS issue was identified in the filename parameter of the admin tool/log route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login a...

BIT-OPENCART-2024-21518

This affects versions of the package opencart/opencart from 4.0.0-0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An...

OpenCart File Leakage Vulnerability

OpenCart is an open source online store management system for creating and managing e-commerce websites. It is known for its user-friendliness and flexibility for online stores of different sizes. OpenCart suffers from a file disclosure vulnerability due to an improperly cleaned destination path...

GHSA-M7R8-2R98-VPPJ Zip slip in opencart

This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An...

Zip slip in opencart

This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An...

Cross site scripting in opencart

This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the directory parameter of admin common/filemanager.list route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompte...

CVE-2024-21518

This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An...

CVE-2024-21518

This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An...

CVE-2024-21518

This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An...

CVE-2024-21518

CVE-2024-21518 affects opencart/opencart versions starting at 4.0.0.0 and is a Zip Slip vulnerability in the marketplace installer. The root cause is improper sanitization of the target path, enabling files contained in a malicious archive to traverse the filesystem and be extracted to arbitrary ...

CVE-2024-21518

This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An...

CVE-2024-21515

This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the admin tool/log route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login a...

OpenCart 安全漏洞

OpenCart is an open source online store management system for creating and managing e-commerce websites. It is known for its user-friendliness and flexibility for online stores of different sizes. OpenCart suffers from a file disclosure vulnerability due to an improperly cleaned destination path...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview opencart/opencart is a shopping cart system Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a...

PT-2024-25: Improper Authorization leads to sensitive data access in UniPORT E-slip

The vulnerability was identified in UniPORT E-slip 1.4.0.0 and lower. The discovered vulnerability is caused by insufficient input data validation. It can be exploited by an attacker to gain access to sensitive application data. The vulnerability is unexploitable in versions 1.4.0.0 and higher...

PT-2024-26: Improper Authorization leads to web administration interface access in UniPORT E-slip

The vulnerability was identified in UniPORT E-slip 1.4.0.0 and lower. The discovered vulnerability is caused by insufficient input data validation. It can be exploited by an attacker to gain access to the application administration web-interface. The vulnerability is unexploitable in versions...