PYSEC-2022-42993

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package. Extracting files using shutil.unpackarchive from a potentially malicious tarball without validating that the destinati...

CVE-2022-23530

CVE-2022-23530 affects GuardDog prior to v0.1.8, where scanning a remotely fetched PyPI package could trigger arbitrary file writes. The root cause is using shutil.unpack_archive() on a crafted tarball without validating that extracted paths stay within the destination directory, allowing writes ...

CVE-2022-23530 GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package. Extracting files using shutil.unpackarchive from a potentially malicious tarball without validating that the destinati...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview github.com/snapcore/snapd/overlord/snapshotstate/backend is a The snapd and snap tools enable systems to work with .snap files. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. When importing a snapshot...

The vulnerability of the Fortinet FortiClient for Windows security tool arises from the insecure management of privileges, allowing attackers to write arbitrary files.

The vulnerability of the Fortinet FortiClient for Windows security tool is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker to write arbitrary files...

py7zr 0.20.0 Directory Traversal

CVE-2022-44900: path traversal vulnerability in py7zr Directory traversal vulnerability in SevenZipFile.extractall function of the python library py7zr version 0.20.0 and earlier allow attackers to read arbitrary files on the local machine via malicious 7z file extraction. CVE-2022-44900...

py7zr 0.20.0 Directory Traversal Vulnerability

CVE-2022-44900: path traversal vulnerability in py7zr Directory traversal vulnerability in SevenZipFile.extractall function of the python library py7zr version 0.20.0 and earlier allow attackers to read arbitrary files on the local machine via malicious 7z file extraction. CVE-2022-44900...

DEBIAN-CVE-2022-44900

A directory traversal vulnerability in the SevenZipFile.extractall function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file...

PYSEC-2022-42998

A directory traversal vulnerability in the SevenZipFile.extractall function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file...

CVE-2022-44900

A directory traversal vulnerability in the SevenZipFile.extractall function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file...

py7zr 路径遍历漏洞

py7zr is a library and utility program by the individual developer Hiroshi Miura. It supports compression, decompression, encryption and decryption of 7zip archives written in the Python programming language. A security vulnerability exists in py7zr version v0.20.0 and earlier versions. An attack...

PT-2022-27330 · Py7Zr +2 · Py7Zr +2

Name of the Vulnerable Software and Affected Versions: py7zr versions 0.20.0 and earlier Description: A directory traversal issue in the SevenZipFile.extractall function allows attackers to write arbitrary files by extracting a crafted 7z file. Recommendations: For py7zr versions 0.20.0 and...

多款Pilz产品路径遍历漏洞

Pilz PASvisu and others are products of Pilz, a German company.Pilz PASvisu is an HMI solution for machine visualization.Pilz PAS4000 is a software platform for the automation system PSS 4000.Pilz PAScal is an application... A path traversal vulnerability exists in several Pilz products. An...

F5 BIG-IP iControl Cross Site Request Forgery Exploit

This Metasploit module exploits a cross-site request forgery CSRF vulnerability in F5 Big-IP's iControl interface to write an arbitrary file to the filesystem. While any file can be written to any location as root, the exploitability is limited by SELinux; the vast majority of writable locations...

F5 BIG-IP iControl Cross Site Request Forgery

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'F5 BIG-IP iControl CSRF File Write SOAP API', 'Description' = %q This module exploits a cross-site request forgery CSRF vulnerability in F5...

(Pwn2Own) Microsoft Teams electronSafeIpc Arbitrary File Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Teams. No user interaction is required if the attacker and target are in the same Teams organization. The specific flaw exists within the communication API. The issue lies in the handling o...

CVE-2022-38165

Arbitrary file write in F-Secure Policy Manager through 2022-08-10 allows unauthenticated users to write the file with the contents in arbitrary locations on the F-Secure Policy Manager Server...

Design/Logic Flaw

Arbitrary file write in F-Secure Policy Manager through 2022-08-10 allows unauthenticated users to write the file with the contents in arbitrary locations on the F-Secure Policy Manager Server...

F-Secure Policy Manager 安全漏洞

F-Secure Policy Manager is an enterprise security solution from Finnish company F-Secure. A security vulnerability exists in F-Secure Policy Manager that originates from a file whose contents can be written in any location by an unauthenticated user, which can be exploited by an attacker to write...

PT-2022-24252 · F Secure · F-Secure Policy Manager +1

Name of the Vulnerable Software and Affected Versions: F-Secure Policy Manager versions prior to 2022-08-10 WithSecure versions prior to 2022-08-10 Description: The issue allows unauthenticated users to perform an arbitrary file write, enabling them to write files with arbitrary contents in vario...