Design/Logic Flaw

An unhandled edge case in the component sanitizedPath of ZipArchive v2.5.4 allows attackers to cause a Denial of Service DoS via a crafted zip file...

CVE-2023-39139

An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file...

PT-2023-26800 · Unknown · Zipfoundation

Name of the Vulnerable Software and Affected Versions: ZIPFoundation version 0.9.16 Description: An issue in ZIPFoundation allows attackers to execute a path traversal via extracting a crafted zip file. Recommendations: For ZIPFoundation version 0.9.16, update to a version that fixes this issue, ...

CVE-2023-39138

An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file...

CVE-2023-39139

The CVE-2023-39139 entry concerns Archive v3.3.7, where a crafted zip file can trigger a path traversal during extraction. Affected component: Archive library (version 3.3.7). Root cause: path traversal vulnerability in zip extraction. Impact: as per CVSS, high confidentiality, integrity, and ava...

CVE-2023-39139

An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file...

CVE-2023-39139

An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file...

CVE-2023-39138

An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file...

SSZipArchive 安全漏洞

SSZipArchive is ZipArchive open source a simple utility class . Used to compress and uncompress files on iOS, macOS and tvOS. A security vulnerability exists in ZipArchive version v2.5.4, which stems from an unhandled edge case in the component sanitizedPath, allowing an attacker to cause a denia...

CVE-2023-39136

An unhandled edge case in the component sanitizedPath of ZipArchive v2.5.4 allows attackers to cause a Denial of Service DoS via a crafted zip file...

CVE-2023-39138

An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file...

China-Linked Bronze Starlight Group Targeting Gambling Sector with Cobalt Strike Beacons

An ongoing cyber attack campaign originating from China is targeting the Southeast Asian gambling sector to deploy Cobalt Strike beacons on compromised systems. Cybersecurity firm SentinelOne said the tactics, techniques, and procedures point to the involvement of a threat actor tracked as Bronze...

CVE-2023-39346

LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21547c25002121cd5 allows attackers to cause a remote code execution on the server side via uploading a crafted ZIP file due to incorrect filtering rules of...

Remote code execution

LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21547c25002121cd5 allows attackers to cause a remote code execution on the server side via uploading a crafted ZIP file due to incorrect filtering rules of...

CVE-2023-39346 bjrjk/LinuxASMCallGraph before commit 20dba06 allows attackers to cause a RCE on the server side via uploading a crafted ZIP file due to incorrect filtering rules of uploaded file

LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21547c25002121cd5 allows attackers to cause a remote code execution on the server side via uploading a crafted ZIP file due to incorrect filtering rules of...

CVE-2023-39346

CVE-2023-39346 — LinuxASMCallGraph suffers a remote code execution via uploading a crafted ZIP file caused by incorrect filtering of uploaded files. Affected: LinuxASMCallGraph before commit 20dba06bd1a3cf260612d4f21547c25002121cd5. Impact: server-side RCE; integrity, confidentiality, and availab...

CVE-2023-39346 bjrjk/LinuxASMCallGraph before commit 20dba06 allows attackers to cause a RCE on the server side via uploading a crafted ZIP file due to incorrect filtering rules of uploaded file

LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21547c25002121cd5 allows attackers to cause a remote code execution on the server side via uploading a crafted ZIP file due to incorrect filtering rules of...

LinuxASMCallGraph Code Issue Vulnerability

LinuxASMCallGraph is an application from Jack Ren's personal developer. It is used to generate function call graphs from the ASM of GNU gcc&g++. LinuxASMCallGraph has a code issue vulnerability that stems from a file upload vulnerability. An attacker can use this vulnerability to cause the server...

java-17-openjdk security and bug fix update

1:17.0.8.0.7-2.0.1 - OpenJDK: ZIP file parsing infinite loop 8302483 CVE-2023-22036 - OpenJDK: weakness in AES implementation 8308682 CVE-2023-22041 - OpenJDK: improper handling of slash characters in URI-to-path conversion 8305312 CVE-2023-22049 - harfbuzz: OpenJDK: On^2 growth via consecutive...

WordPress Update Theme and Plugins from Zip File Plugin <= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Update Theme and Plugins from Zip File Type Plugin Vulnerable versions = 2.0.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25489 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e0461fa05dda Credit...