CVE-2023-39138: Improper Limitation of a Pathname to a Restricted Directory

An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file...

CVE-2023-39138

An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file...

CVE-2023-39139

An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file...

SSZipArchive 安全漏洞

SSZipArchive is ZipArchive open source a simple utility class . Used to compress and uncompress files on iOS, macOS and tvOS. A security vulnerability exists in ZipArchive version v2.5.4, which stems from an unhandled edge case in the component sanitizedPath, allowing an attacker to cause a denia...

CVE-2023-39138

An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file...

CVE-2023-39136

An unhandled edge case in the component sanitizedPath of ZipArchive v2.5.4 allows attackers to cause a Denial of Service DoS via a crafted zip file...

China-Linked Bronze Starlight Group Targeting Gambling Sector with Cobalt Strike Beacons

An ongoing cyber attack campaign originating from China is targeting the Southeast Asian gambling sector to deploy Cobalt Strike beacons on compromised systems. Cybersecurity firm SentinelOne said the tactics, techniques, and procedures point to the involvement of a threat actor tracked as Bronze...

CVE-2023-39346

LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21547c25002121cd5 allows attackers to cause a remote code execution on the server side via uploading a crafted ZIP file due to incorrect filtering rules of...

Remote code execution

LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21547c25002121cd5 allows attackers to cause a remote code execution on the server side via uploading a crafted ZIP file due to incorrect filtering rules of...

CVE-2023-39346 bjrjk/LinuxASMCallGraph before commit 20dba06 allows attackers to cause a RCE on the server side via uploading a crafted ZIP file due to incorrect filtering rules of uploaded file

LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21547c25002121cd5 allows attackers to cause a remote code execution on the server side via uploading a crafted ZIP file due to incorrect filtering rules of...

CVE-2023-39346

CVE-2023-39346 — LinuxASMCallGraph suffers a remote code execution via uploading a crafted ZIP file caused by incorrect filtering of uploaded files. Affected: LinuxASMCallGraph before commit 20dba06bd1a3cf260612d4f21547c25002121cd5. Impact: server-side RCE; integrity, confidentiality, and availab...

CVE-2023-39346 bjrjk/LinuxASMCallGraph before commit 20dba06 allows attackers to cause a RCE on the server side via uploading a crafted ZIP file due to incorrect filtering rules of uploaded file

LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21547c25002121cd5 allows attackers to cause a remote code execution on the server side via uploading a crafted ZIP file due to incorrect filtering rules of...

LinuxASMCallGraph Code Issue Vulnerability

LinuxASMCallGraph is an application from Jack Ren's personal developer. It is used to generate function call graphs from the ASM of GNU gcc&g++. LinuxASMCallGraph has a code issue vulnerability that stems from a file upload vulnerability. An attacker can use this vulnerability to cause the server...

CVE-2023-39346: Unrestricted Upload of File with Dangerous Type

LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21547c25002121cd5 allows attackers to cause a remote code execution on the server side via uploading a crafted ZIP file due to incorrect filtering rules of...

java-17-openjdk security and bug fix update

1:17.0.8.0.7-2.0.1 - OpenJDK: ZIP file parsing infinite loop 8302483 CVE-2023-22036 - OpenJDK: weakness in AES implementation 8308682 CVE-2023-22041 - OpenJDK: improper handling of slash characters in URI-to-path conversion 8305312 CVE-2023-22049 - harfbuzz: OpenJDK: On^2 growth via consecutive...

WordPress Update Theme and Plugins from Zip File Plugin <= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Update Theme and Plugins from Zip File Type Plugin Vulnerable versions = 2.0.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25489 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e0461fa05dda Credit...

Denial Of Service (DoS)

gitlab is vulnerable to Denial of Service DoS attacks. An attacker might use a forged CI job artifact zip file in a project that employs dynamic child pipelines to cause a sidekiq task to use a large amount of RAM. This may result in a Denial of Service on GitLab instances where Sidekiq is...

RHEL 7 : java-11-openjdk (RHSA-2023:4233)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4233 advisory. The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fixe...

Moderate: Red Hat Security Advisory: java-11-openjdk security and bug fix update

An update for java-11-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Denial Of Service (DoS)

ethyca-fides is vulnerable to Denial Of Service DoS. The vulnerability exists due to the lack of validation checks for SVGs in the savetemplate function of connectorregistryservice.py, which allows an admin authenticated attacker to crash the application by uploading a zip file containing a...