324 matches found
CVE-2023-39312 WordPress Avada theme <= 7.11.1 - Auth. Unrestricted Zip Extraction vulnerability
Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1...
CVE-2023-39312 WordPress Avada theme <= 7.11.1 - Auth. Unrestricted Zip Extraction vulnerability
Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1...
CVE-2024-22405
XADMaster is an objective-C library for archive and file unarchiving and extraction. When extracting a specially crafted zip archive XADMaster may not apply quarantine attribute correctly. Such behaviour may circumvent Gatekeeper checks on the system. Only macOS installations are affected. This...
CVE-2023-31090 WordPress Unlimited Elements For Elementor plugin <= 1.5.60 - Unrestricted Zip Extraction vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Upload a Web Shell to a Web Server.This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through 1.5....
Avada < 7.11.2 - Author+ Arbitrary File Upload via Zip Extraction
Description The theme is vulnerable to arbitrary file uploads due to missing file type validation when extracting zip files in the 'processupload' and 'regenerateiconfiles' functions. This makes it possible for authenticated attackers with author permissions to upload arbitrary files on the...
WordPress plugin WP All Import security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...
VulnCheck KEV: CVE-2021-24284
The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fontsicon directory with no checks for malicious files such as PHP...
Nextcloud: Can download files by zipping the folder
A vulnerability was identified where files could be downloaded without proper permissions by zipping and downloading a folder, despite not having direct download access. This allowed circumvention of view-only restrictions...
PT-2023-6213 · South River Technologies · Titan Mft +1
Name of the Vulnerable Software and Affected Versions: South River Technologies' Titan MFT and Titan SFTP servers affected versions not specified Description: The issue is related to insufficient path validation when extracting a zip archive, allowing an authenticated attacker to write a file to...
South River Technologies TitanFTP NextGen Path Traversal Vulnerability
South River Technologies TitanFTP NextGen South River Technologies Titan FTP NextGen is a natively supported cluster for high availability and failover SFTP/ FTP server. A security vulnerability exists in South River Technologies TitanFTP NextGen that stems from insufficient validation of paths...
SUSE CVE-2023-43616
An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...
GHSA-8C8W-F7WP-2JR2 Sender can cause a receiver to overwrite files during ZIP extraction in Croc
An issue was discovered in Croc before 9.6.16. A sender can cause a receiver to overwrite files during ZIP extraction...
Sender can cause a receiver to overwrite files during ZIP extraction in Croc
An issue was discovered in Croc before 9.6.16. A sender can cause a receiver to overwrite files during ZIP extraction...
CVE-2023-43616
An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...
Code injection
An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...
CVE-2023-43616
An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...
CVE-2023-43616
CVE-2023-43616 affects Croc through version 9.6.5; a sender can cause the receiver to overwrite files during ZIP extraction due to the ZIP extraction handling. Impact is local and relates to file overwrites during extraction. The provided documents do not specify a fixed version or a remediation,...
CVE-2023-43616
An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...
Path Traversal
Zip Swift is vulnerable to Zip Path Traversal vulnerability Zip Slip. The vulnerability is due to not sanitizing zip entry while extracting zip files in a destination directory inside a unzipFile function. An attacker can a create a maliciously crafted zip entry which can be extracted to arbitrar...