CVE-2021-33896

Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal only for creation of new files via URI-encoded path separators...

CVE-2021-33896

Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal only for creation of new files via URI-encoded path separators...

Directory traversal

Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal only for creation of new files via URI-encoded path separators...

CVE-2021-33896

Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal only for creation of new files via URI-encoded path separators...

CVE-2021-33896

Dino before 0.1.2 and 0.2.x before 0.2.1 is vulnerable to directory traversal via URI-encoded path separators when creating new files. The underlying issue allows a remote attacker to create files in arbitrary locations in the context of the user, by tricking them into downloading a crafted file ...

CVE-2021-33896

Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal only for creation of new files via URI-encoded path separators...

CVE-2021-33896

Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal only for creation of new files via URI-encoded path separators...

CVE-2021-33896

Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal only for creation of new files via URI-encoded path separators...

CVE-2021-33896: Improper Limitation of a Pathname to a Restricted Directory

Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal only for creation of new files via URI-encoded path separators...

WP Hardening < 1.2.2 - Reflected XSS via URI

The plugin did not sanitise or escape the $SERVER'REQUESTURI' before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue. https://example.com/wp-admin/plugins.php?%22%3E%3Cscript%3Ealertdocument.domain%3C/script%3Cv=...

CVE-2021-33896

Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal only for creation of new files via URI-encoded path separators...

dino -- Path traversal in Dino file transfers

Dino team reports: It was discovered that when a user receives and downloads a file in Dino, URI-encoded path separators in the file name will be decoded, allowing an attacker to traverse directories and create arbitrary files in the context of the user...

PT-2021-4277

Name of the Vulnerable Software and Affected Versions Dino versions 0.1.2 and earlier Dino versions 0.2.x before 0.2.1 Description The issue is related to an error with URI-encoded path separators, allowing for Directory Traversal, but only for the creation of new files. This could potentially...

Dino path traversal vulnerability

Dino is an open source chat client application for desktop from the Dino DINO team. Dino suffers from a path traversal vulnerability that stems from Dino prior to 0.1.2 and 0.2 failing to properly filter for special elements in the path of a resource or file. An attacker could use this...

Insecure Container Configuration

github.com/hpcng/singularity uses insecure container configuration. An attacker is able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a victim with a non-default remote endpoint...

Insecure Container Configuration

github.com/sylabs/singularity uses insecure container configuration. An attacker is able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a victim with a non-default remote endpoint...

GHSA-5MV9-Q7FQ-9394 Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint

Impact Due to incorrect use of a default URL, singularity action commands run/shell/exec specifying a container using a library:// URI will always attempt to retrieve the container from the default remote endpoint cloud.sylabs.io rather than the configured remote endpoint. An attacker may be able...

Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint

Impact Due to incorrect use of a default URL, singularity action commands run/shell/exec specifying a container using a library:// URI will always attempt to retrieve the container from the default remote endpoint cloud.sylabs.io rather than the configured remote endpoint. An attacker may be able...

Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint

Impact Due to incorrect use of a default URL, singularity action commands run/shell/exec specifying a container using a library:// URI will always attempt to retrieve the container from the default remote endpoint cloud.sylabs.io rather than the configured remote endpoint. An attacker may be able...

AZL-37062 CVE-2020-27748 affecting package xdg-utils 1.2.1-3

A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive fil...