PT-2023-32448 · Espocrm · Espocrm

Name of the Vulnerable Software and Affected Versions: EspoCRM version 7.2.5 Description: An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server via the extension deployment form, which could lead to arbitrary PHP code execution. Recommendations: For EspoC...

CVE-2023-5965: Unrestricted Upload of File with Dangerous Type

An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution...

PT-2023-32447 · Espocrm · Espocrm

Name of the Vulnerable Software and Affected Versions: EspoCRM version 7.2.5 Description: An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server via the update form, which could lead to arbitrary PHP code execution. Recommendations: For EspoCRM version...

Denial Of Service (DoS)

mattermost is vulnerable to Denial Of Service attack. The vulnerability is caused due to a lack of validation while performing zip file extraction. An attacker is able to upload a specially crafted zip zip bomb, which upon extraction leads to consumption of excessive resources...

GHSA-J4C3-3H73-74M9 Mattermost Uncontrolled Resource Consumption vulnerability

Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip zip bomb...

Mattermost Uncontrolled Resource Consumption vulnerability

Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip zip bomb...

CVE-2023-48268

Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip zip bomb...

Design/Logic Flaw

Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip zip bomb...

CVE-2023-48268

CVE-2023-48268: Mattermost Boards import can be exploited via a specially crafted zip to exhaust resources during archive extraction, causing Denial of Service. The accessible connected sources indicate the issue stems from failing to limit data extracted from compressed archives during board imp...

CVE-2023-48268 Denial of Service via Board Import Zip Bomb

Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip zip bomb...

CVE-2023-48268 Denial of Service via Board Import Zip Bomb

Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip zip bomb...

CVE-2023-48268

Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip zip bomb...

PT-2023-30750 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue allows an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip zip bomb in Mattermost Boards. This...

CVE-2023-48268: Uncontrolled Resource Consumption

Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip zip bomb...

Malicious code in place-zip-autocomplete-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 80a9eda07bbcecc8a168b9ef0252e04b4b97abe222e5d8445113a1ae34c71a6d The OpenSSF Package Analysis project identified 'place-zip-autocomplete-input' @ 3.7.14 npm as malicious. It is considered malicious because: -...

PT-2023-31056 · 7 Zip · 7Za

Name of the Vulnerable Software and Affected Versions: NZBGet version 21.1 Description: The issue allows authenticated remote code execution due to the unarchive programs 7za and unrar preserving executable file permissions. An attacker with Control capability can execute a file by setting the...

GHSA-M2MJ-PR4F-H9JP TorchServe ZipSlip

Impact Using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are extracted to any location on the filesystem that is within the process permissions. Leveraging this issue could aid third-party actors in hiding harmful code in...

PT-2023-30766

Name of the Vulnerable Software and Affected Versions TorchServe versions 0.1.0 through 0.9.0 Description The issue allows uploading potentially harmful archives that contain files extracted to any location on the filesystem within the process permissions, using the model/workflow management API...

Exploit for CVE-2023-36025

CVE-2023-36025 Simple test for CVE-2023-36025, based...

GHSA-897X-XVJ8-42RQ Zip slip in mleap

FileUtil.extract enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directory. When creating an instance of TensorflowModel using the savedmodel format and an exported tensorflow model, the apply function invokes th...