146 matches found
CVE-2026-40180 Zip Slip Path Traversal in quarkus-openapi-generator ApicurioCodegenWrapper class
Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to 2.16.0 and 2.15.0-lts, the unzip method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output...
quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class
Summary A path traversal vulnerability was discovered in the quarkus-openapi-generator extension Details The unzip method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is...
CVE-2024-36057
CVE-2024-36057 affects Koha Library prior to 23.05.10. The vulnerability stems from insufficient sanitization of user-controlled filenames before unzipping, allowing command injection via the shell in the unzip invocation within upload-cover-image.pl (example: the code executes qx/unzip $filename...
CVE-2024-36057
Koha Library before 23.05.10 fails to sanitize user-controllable filenames prior to unzipping, leading to remote code execution. The line "qx/unzip $filename -d $dirname/;" in upload-cover-image.pl is vulnerable to command injection via shell metacharacters because input data can be controlled by...
PT-2026-30839
Koha Library before 23.05.10 fails to sanitize user-controllable filenames prior to unzipping, leading to remote code execution. The line "qx/unzip $filename -d $dirname/;" in upload-cover-image.pl is vulnerable to command injection via shell metacharacters because input data can be controlled by...
Low: unzip
Issue Overview: Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service resource consumption, aka a "better zip bomb" issue. CVE-2019-13232 Affected Packages: unzip Issue Correction: Run dnf update unzip --releasever 2023.10.20260202 or dnf upda...
Amazon Linux 2023 : unzip (ALAS2023-2026-1422)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1422 advisory. Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service resource consumption, aka a better zip bomb issue. CVE-2019-13232 Tenable has extracted the...
MiracleLinux 8 : unzip-6.0-43.el8 (AXSA:2020-297:02)
The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2020-297:02 advisory. unzip: overlapping of files in ZIP container leads to denial of service CVE-2019-13232 Tenable has extracted the preceding description block directly from the...
MiracleLinux 7 : unzip-6.0-21.el7 (AXSA:2020-4547:01)
The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2020-4547:01 advisory. unzip: overlapping of files in ZIP container leads to denial of service CVE-2019-13232 Tenable has extracted the preceding description block directly from th...
MiracleLinux 7 : unzip-6.0-20.el7 (AXSA:2019-4176:01)
The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2019-4176:01 advisory. unzip: Buffer overflow in list.c resulting in a denial of service CVE-2018-18384 Tenable has extracted the preceding description block directly from the...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues
Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues. We have updated the base image used by our Speech Services and the following vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2021-3572...
EUVD-2005-4661
Malware in sbrugna...
EUVD-2021-34075
Malicious code in bioql PyPI...
EUVD-2022-15656
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2022-0530
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This fl...
Linux Distros Unpatched Vulnerability : CVE-2018-14346
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU Libextractor before 1.7 has a stack-based buffer overflow in ecreadfilefunc unzip.c. CVE-2018-14346 Note that Nessus relies on the presence of the package a...
Linux Distros Unpatched Vulnerability : CVE-2017-14719
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components. CVE-2017-14719...
CVE-2025-54473
An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered. The issue allows code execution via the unzip feature...
