VulnCheck KEV: CVE-2021-24284

The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fontsicon directory with no checks for malicious files such as PHP...

Nextcloud: Can download files by zipping the folder

A vulnerability was identified where files could be downloaded without proper permissions by zipping and downloading a folder, despite not having direct download access. This allowed circumvention of view-only restrictions...

South River Technologies TitanFTP NextGen Path Traversal Vulnerability

South River Technologies TitanFTP NextGen South River Technologies Titan FTP NextGen is a natively supported cluster for high availability and failover SFTP/ FTP server. A security vulnerability exists in South River Technologies TitanFTP NextGen that stems from insufficient validation of paths...

PT-2023-6213 · South River Technologies · Titan Mft +1

Name of the Vulnerable Software and Affected Versions: South River Technologies' Titan MFT and Titan SFTP servers affected versions not specified Description: The issue is related to insufficient path validation when extracting a zip archive, allowing an authenticated attacker to write a file to...

SUSE CVE-2023-43616

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...

GHSA-8C8W-F7WP-2JR2 Sender can cause a receiver to overwrite files during ZIP extraction in Croc

An issue was discovered in Croc before 9.6.16. A sender can cause a receiver to overwrite files during ZIP extraction...

Sender can cause a receiver to overwrite files during ZIP extraction in Croc

An issue was discovered in Croc before 9.6.16. A sender can cause a receiver to overwrite files during ZIP extraction...

CVE-2023-43616

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...

Code injection

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...

CVE-2023-43616

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...

CVE-2023-43616

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...

CVE-2023-43616

CVE-2023-43616 affects Croc through version 9.6.5; a sender can cause the receiver to overwrite files during ZIP extraction due to the ZIP extraction handling. Impact is local and relates to file overwrites during extraction. The provided documents do not specify a fixed version or a remediation,...

Path Traversal

Zip Swift is vulnerable to Zip Path Traversal vulnerability Zip Slip. The vulnerability is due to not sanitizing zip entry while extracting zip files in a destination directory inside a unzipFile function. An attacker can a create a maliciously crafted zip entry which can be extracted to arbitrar...

GHSA-C2CC-3569-6JH2 Path traversal in ZIPFoundation

An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file...

CVE-2023-39138

An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file...

CVE-2023-39139

An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file...

Path traversal

An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file...

Archive 路径遍历漏洞

Archive is a Dart library for encoding and decoding various archive and compression formats such as Zip, Tar, GZip, ZLib and BZip2. A security vulnerability exists in Archive version v3.3.7 that originates from allowing an attacker to perform path traversal by extracting a carefully crafted zip...

CVE-2022-46902

An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is a Path Traversal for an Unzip operation. The Vocera Report Console contains a websocket function that allows for the restoration of the database from a ZIP archive that expects a SQL import file. During the...

CVE-2021-4330

The Envato Elements & Download and Template Kit – Import plugins for WordPress are vulnerable to arbitrary file uploads due to insufficient validation of file type upon extracting uploaded Zip files in the installFreeTemplateKit and uploadTemplateKitZipFile functions. This makes it possible for...