137 matches found
CVE-2020-36560 Path traversal in github.com/artdarek/go-unzip
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
CVE-2018-25046 Path traversal in code.cloudfoundry.org/archiver
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
archiver 路径遍历漏洞
archiver is a compression/decompression utility program. A path traversal vulnerability exists in archiver, which stems from an incorrect path, where an archive file containing a relative file path could result in the file being written or overwritten outside of the target directory...
UBUNTU-CVE-2022-32287
A relative path traversal vulnerability in a FileUtil class used by the PEAR management component of Apache UIMA allows an attacker to create files outside the designated target directory using carefully crafted ZIP entry names. This issue affects Apache UIMA Apache UIMA version 3.3.0 and prior...
rsync: remote arbitrary files write inside the directories of connecting peers
A flaw was found in rsync that is triggered by a victim rsync user/client connecting to a malicious rsync server. The server can copy and overwrite arbitrary files in the client's rsync target directory and subdirectories. This flaw allows a malicious server, or in some cases, another attacker wh...
rsync: remote arbitrary files write inside the directories of connecting peers
A flaw was found in rsync that is triggered by a victim rsync user/client connecting to a malicious rsync server. The server can copy and overwrite arbitrary files in the client's rsync target directory and subdirectories. This flaw allows a malicious server, or in some cases, another attacker wh...
Directory Traversal
rsync is vulnerable to Directory Traversal. The vulnerability exists due to a lack of validation of file names allowed, allowing a malicious rsync server or Man-in-The-Middle attacker to overwrite arbitrary files in the rsync client target directory and subdirectories...
OESA-2022-1805 targetcli security update
Targetcli is an administration tool for managing storage targets using the kernel LIO core target and compatible target fabric modules. Security Fixes: Open-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target and for the backup directory and backup files.CVE-2020-13867...
CVE-2022-29154
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...
CVE-2022-29154
An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...
squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.
...
CVE-2021-33725
A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. The affected system allows to delete arbitrary files or directories under a user controlled path and does not correctly check if the relative path is still within the intended target directory...
Archive package allows chmod of file outside of unpack target directory
...
GO-2020-0042 Arbitrary File Write via Archive Extraction (Zip Slip) in github.com/sassoftware/go-rpmutils
Due to improper path sanitization, RPMs containing relative file paths can cause files to be written or overwritten outside of the target directory...
GO-2020-0026 Arbitrary file write via archive extraction in github.com/openshift/source-to-image
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
PT-2021-12076 · Github.Com/Yi Ge/Unzip +3 · Github.Com/Yi-Ge/Unzip +1
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is caused by improper path sanitization, allowing archives with relative file paths to write or overwrite files outside the intended directory...
KonaWiki Security Breach
KonaWiki is a lightweight Wiki system. The system is primarily used for writing manuscripts, keeping meeting minutes and memos, etc. A security vulnerability exists in KonaWiki version 3.1.1 and prior versions, which due to insufficient query checking allows a remote attacker to unauthorizedly...
targetcli: weak permissions for /etc/target and backup files
An access flaw was found in targetcli, where the /etc/target and underneath backup directory/files were world-readable. This flaw allows a local attacker to access potentially sensitive information such as authentication credentials from the /etc/target/saveconfig.json and backup files. The highe...
Unspecified vulnerability in Open-iSCSI targetcli-fb
Open-iSCSI targetcli-fb is a command line interface for managing Linux LIO kernel targets. A security vulnerability in /etc/target as well as the backup directory and backup files in Open-iSCSI targetcli-fb 2.1.52 and earlier versions can be exploited by an attacker to view or modify the contents...