CVE-2024-24789

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects...

PT-2024-4044 · Unknown +10 · Archive/Zip +10

Name of the Vulnerable Software and Affected Versions: archive/zip package affected versions not specified Description: The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create a...

CVE-2018-13410 affecting package zip for versions less than 3.0-6

CVE-2018-13410 affecting package zip for versions less than 3.0-6. A patched version of the package is available...

CVE-2023-3231

A vulnerability has been found in UJCMS up to 6.0.2 and classified as problematic. This vulnerability affects unknown code of the component ZIP Package Handler. The manipulation of the argument dir leads to information disclosure. The attack can be initiated remotely. The complexity of an attack ...

CVE-2023-3231

CVE-2023-3231 affects UJCMS up to version 6.0.2, specifically the ZIP Package Handler’s dir parameter, enabling information disclosure through remote access. The vulnerability arises from manipulation of the dir argument in unknown ZIP Package Handler code; exploitation is reportedly difficult bu...

PT-2023-23719 · Ujcms · Ujcms

Name of the Vulnerable Software and Affected Versions: UJCMS versions up to 6.0.2 Description: A vulnerability has been found in the ZIP Package Handler component of UJCMS, which can lead to information disclosure through the manipulation of the dir argument. The attack can be initiated remotely,...

CVE-2023-3231: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability has been found in UJCMS up to 6.0.2 and classified as problematic. This vulnerability affects unknown code of the component ZIP Package Handler. The manipulation of the argument dir leads to information disclosure. The attack can be initiated remotely. The complexity of an attack ...

Security Bulletin: Multiple Vulnerabilities in Apache Commons Compress affect WebSphere Application Server used by IBM Maximo Application Suite

Summary Multiple Vulnerabilities in Apache Commons Compress affect WebSphere Application Server used by IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an out of memory error when...

多款Western Digital产品路径遍历漏洞

Western Digital My Cloud Home is an easy-to-use personal cloud storage device.Western Digital My Cloud Home Duo is an easy-to-use cloud storage device.SanDisk ibi is an intelligent photo manager and media storage drive. Western Digital My Cloud Home Duo is an easy-to-use personal cloud storage...

new packages: zip

An update is available for zip. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9.0...

CVE-2018-13410 affecting package zip for versions less than 3.0-5

CVE-2018-13410 affecting package zip for versions less than 3.0-5. A patched version of the package is available...

GitHub Desktop (MacOS) Code Execution Vulnerability

Github Desktop is an application that allows users to interact with GitHub using a GUI rather than a command line or web browser.The GitHub Desktop macOS code execution vulnerability allows attackers to use URLs such as smb or openlocalrepo to implement a 1 click RCE attack, which results in code...

CVE-2022-0401

Path Traversal in NPM w-zip prior to 1.0.12...

Security Bulletin: Multiple vulnerabilities in IBM Websphere Application Server affect the IBM Performance Management product

Summary Multiple vulnerabilities in IBM Websphere Application Server - Liberty could allow a remote attacker to exploit them to cause a denial of service condition against services that use Compress' zip package. IBM Performance Management has addressed the applicable CVEs. Vulnerability Details...

SUSE-RU-2021:3315-1 Recommended update for go1.17

This update for go1.17 fixes the following issues: This is the initial go 1.17 shipment. go1.17.1 released 2021-09-09 includes a security fix to the archive/zip package, as well as bug fixes to the compiler, linker, the go command, and to the crypto/rand, embed, go/types, html/template, and...

UBUNTU-CVE-2021-36090

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package...

PT-2021-3726

Name of the Vulnerable Software and Affected Versions Apache Commons Compress versions 1.19 through 1.21 Confluence Data Center versions from 7.19.23 to 8.9.3 Confluence Data Center versions from 8.5.10 to 8.5.11 Confluence Server versions from 7.19.23 to 7.19.24 Confluence Server versions from...

Path traversal

An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path...

CVE-2021-26028: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path...

CVE-2020-7664

The CVE-2020-7664 issue affects the Go package github.com/unknwon/cae/zip, specifically the ExtractTo function. The vulnerability arises because ExtractTo does not securely escape file paths in zip archives that contain leading or non-leading “..”, enabling path traversal that could allow an atta...