143 matches found
Directory Traversal
pythonlibarchive is vulnerable to Directory Traversal. The vulnerability is due to insufficient sanitization of file paths during the extraction process, which fails to properly handle or restrict the traversal of directory paths, allowing attackers to use special characters such as ../ to escape...
Security update for gradle
This update for gradle fixes the following issues: CVE-2023-35947: Fixed an issue while unpacking tar archives, where files could be created outside of the unpack location bsc1212931. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...
Path Traversal
helm.sh/helm is vulnerable to Path Traversal. The vulnerability is due to improper validation of file paths in chart archives, which allows files to be extracted outside the target directory when unpacking...
Extract 安全漏洞
Extract is a Go library open-sourced by codeclysm. It is used to extract archives in zip, tar.gz or tar.bz2 format. A security vulnerability exists in Extract versions prior to 4.0.0, which stems from a maliciously constructed archive file that allows an attacker to create symbolic links outside ...
PT-2024-32867 · Extract +1 · Textract +1
Name of the Vulnerable Software and Affected Versions: Extract versions prior to 4.0.0 Description: A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory. This issue can be exploited by using a specially crafted archive in zip, tar.gz, or...
USN-7030-1 py7zr vulnerability
It was discovered that py7zr was vulnerable to path traversal attacks. If a user or automated system were tricked into extracting a specially crafted 7z archive, an attacker could possibly use this issue to write arbitrary files outside the target directory on the host...
CVE-2024-7986 Rockwell Automation ThinManager® ThinServer™ Information Disclosure
A vulnerability exists in the Rockwell Automation ThinManager® ThinServer that allows a threat actor to disclose sensitive information. A threat actor can exploit this vulnerability by abusing the ThinServer™ service to read arbitrary files by creating a junction that points to the target directo...
GO-2022-0921 Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd
Archive package allows chmod of file outside of unpack target directory in github.com/containerd/containerd...
USN-6755-1 cpio vulnerabilities
Ingo Brückl discovered that cpio contained a path traversal vulnerability. If a user or automated system were tricked into extracting a specially crafted cpio archive, an attacker could possibly use this issue to write arbitrary files outside the target directory on the host, even if using the...
CVE-2023-50922
An issue was discovered on GL.iNet devices through 4.5.0. Attackers who are able to steal the AdminToken cookie can execute arbitrary code by uploading a crontab-formatted file to a specific directory and waiting for its execution. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000...
Code injection
Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the Install assessment functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted T...
CVE-2023-32676 Autolab tar slip in Install Assessment functionality (`GHSL-2023-081`)
Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the Install assessment functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted T...
The vulnerability of the targetcli iSCSI-client’s command interface allows a hacker to gain access to confidential data.
The vulnerability of the targetcli iSCSI client’s command shell is related to the lack of access control over the /etc/target directory, the backup directory, and the backup files. Exploiting this vulnerability allows an attacker to gain access to confidential data...
SUSE CVE-2020-13867
Open-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target and for the backup directory and backup files...
tar-utils Path Traversal vulnerability
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
Unzip vulnerable to path traversal
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
CVE-2020-36560
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
CVE-2018-25046
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
