Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any...

GHSA-3JFQ-G458-7QM9 Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any...

CVE-2021-32803 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning

The npm package "tar" aka node-tar before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in...

CVE-2021-32803

The npm package "tar" aka node-tar before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in...

Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in...

GHSA-R628-MHMH-QJHW Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in...

node-tar 后置链接漏洞

node-tar is a software package for file compression/decompression. A backlink vulnerability exists in node-tar, which is an arbitrary file creation/overwrite vulnerability that stems from insufficient symbolic link protection...

node-tar 路径遍历漏洞

node-tar is a software package for file compression/decompression. A path traversal vulnerability exists in node-tar, which is an arbitrary file creation/overwrite vulnerability that stems from insufficient absolute path cleanup...

PT-2021-5776 · Npm +9 · Node-Tar +9

Name of the Vulnerable Software and Affected Versions: node-tar versions prior to 3.2.3 node-tar versions prior to 4.4.15 node-tar versions prior to 5.0.7 node-tar versions prior to 6.1.2 Description: The issue is related to insufficient symlink protection in the node-tar module for handling tar...

PT-2021-5756 · Npm +7 · Node-Tar +7

Name of the Vulnerable Software and Affected Versions: node-tar versions prior to 3.3.2, 4.4.14, 5.0.6, and 6.1.1 Description: The issue is related to the node-tar module for handling tar archives in Node.js, which has a problem with incorrect filtering of the '/' character sequence. This could...

CVE-2021-23407

The CVE-2021-23407 issue affects elFinder.Net.Core (versions 0 up to

ZOOK 输入验证错误漏洞

ZOOK is a Korean remote control service program that can control a remote PC from an Android phone. A security vulnerability exists in the ZOOK software remote administration tool, which can be exploited by an attacker to create and execute arbitrary files in the ZOOK agent program using the "Tig...

SUSE: Security Advisory (SUSE-SU-2014:0188-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

HPESBUX04160 rev.2 - HP-UX OpenSSL, Multiple Vulnerabilities

Potential Security Impact: Local: Unauthorized Access to Diagnostic Data, Unauthorized Arbitrary File Creation, Unqualified Configuration Change; Remote: Unauthorized Access to Diagnostic Data, Unauthorized Arbitrary File Creation SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed...

USN-4937-2 gnome-autoar regression

USN-4937-1 fixed a vulnerability in GNOME Autoar. The update caused a regression when extracting certain archives. This update fixes the problem. Original advisory details: Ondrej Holy discovered that GNOME Autoar could extract files outside of the intended directory. If a user were tricked into...

QNAP NAS MusicStation Directory Traversal Arbitrary File Creation Vulnerability

This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of QNAP NAS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MusicStation application. When parsing the arttype request parameter, the process...

USN-4937-1 gnome-autoar vulnerability

Ondrej Holy discovered that GNOME Autoar could extract files outside of the intended directory. If a user were tricked into extracting a specially crafted archive, a remote attacker could create files in arbitrary locations, possibly leading to code execution...

CVE-2021-29100

A path traversal vulnerability exists in Esri ArcGIS Earth versions 1.11.0 and below which allows arbitrary file creation on an affected system through crafted input. An attacker could exploit this vulnerability to gain arbitrary code execution under security context of the user running ArcGIS...

CVE-2021-29100

A path traversal vulnerability exists in Esri ArcGIS Earth versions 1.11.0 and below which allows arbitrary file creation on an affected system through crafted input. An attacker could exploit this vulnerability to gain arbitrary code execution under security context of the user running ArcGIS...

Path traversal

A path traversal vulnerability exists in Esri ArcGIS Earth versions 1.11.0 and below which allows arbitrary file creation on an affected system through crafted input. An attacker could exploit this vulnerability to gain arbitrary code execution under security context of the user running ArcGIS...