14944 matches found
github.com/jaraco/zipp: Denial of Service (infinite loop) via crafted zip file in jaraco/zipp
A flaw was found in jaraco/zipp. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is...
Exploit for Path Traversal in Ollama
CVE-2024-45436 Attack Example Code POC CVE-2024-45436 i...
PT-2024-34609 · Visicut · Visicut
Name of the Vulnerable Software and Affected Versions: VisiCut version 2.1 Description: The issue allows attackers to execute arbitrary code via uploading a crafted Zip file, exploiting an arbitrary file upload vulnerability in the importSettings method. Recommendations: For VisiCut version 2.1,...
7-Zip Zstandard Code Execution
The vulnerability of the Zstandard compression method used by the 7-Zip archive manager is related to integer overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code, provided that the user opens a specially crafted archive...
7-Zip Qcow Handler Infinite Loop Denial-of-Service Vulnerability
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processin...
PT-2024-8763
Name of the Vulnerable Software and Affected Versions 7-Zip versions prior to 24.08 Description The issue is related to a logic error in the processing of streams, which can lead to an infinite loop. This allows remote attackers to create a denial-of-service condition on affected installations of...
CVE-2024-51365
CVE-2024-51365 entry is rejected/not used; withdrawn by CNA and not a security issue.
U.S. Dept Of Defense: Exposed Extremely Sensitive Information in Public ZIP File
A publicly accessible ZIP file containing sensitive information, including SMTP credentials, database connection details, and AWS secret keys, was discovered. The sensitive data was exposed due to the lack of proper access controls and encryption. The exposed credentials could have been misused f...
7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the implementation of...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via the asset upload functionality. An attacker can place files in unintended locations on the server by uploading files with specially crafted filenames. Details A Directory Traversal attack also known as path...
Security update for SUSE Manager Salt Bundle
This update fixes the following issues: venv-salt-minion: Security fixes on Python 3.11 interpreter: CVE-2024-7592: Fixed quadratic complexity in parsing -quoted cookie values with backslashes bsc1229873, bsc1230059 CVE-2024-8088: Prevent malformed payload to cause infinite loops in zipfile.Path...
Fedora: Security Advisory (FEDORA-2024-e7bb8bc2da)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Important: Red Hat Security Advisory: ACS 4.4 enhancement update
Updated images are now available for Red Hat Advanced Cluster Security RHACS. The updated image includes a bug fix and security fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal through the IsDoneWithOutputToBaseDir method of the src/Zip.Shared/ZipEntry.Extract.cs component. This vulnerability derives from an incomplete fix of CVE-2018-1002205 Details A Directory Traversal attack also known ...
USN-7107-1 zlib vulnerability
It was discovered that Minizip in zlib incorrectly handled certain zip header fields. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code...
Amazon Linux 2 : libreoffice (ALASLIBREOFFICE-2024-005)
The version of libreoffice installed on the remote host is prior to 5.3.6.1-21. It is, therefore, affected by a vulnerability as referenced in the ALAS2LIBREOFFICE-2024-005 advisory. Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice...
Important: libreoffice
Issue Overview: Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in LibreOfficeThis issue affects LibreOffice: from 24.2 before 24.2.5. CVE-2024-7788 Affected Packages: libreoffice Note: This...
Amazon Linux 2 : python38 (ALASPYTHON3.8-2024-016)
The version of python38 installed on the remote host is prior to 3.8.20-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PYTHON3.8-2024-016 advisory. Directory traversal vulnerability in the 1 extract and 2 extractall functions in the tarfile module in Python...