UBUNTU-CVE-2018-10860

perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary...

CVE-2018-1000544

CVE-2018-1000544 affects the rubyzip gem (versions up to and including 1.2.1). It enables a Directory Traversal in Zip::File that can write arbitrary files to the filesystem when processing crafted ZIPs (e.g., using symlinks or absolute paths). Public advisories (e.g., Debian DLA-2307-1, RH advis...

Arbitrary File Write

orientdb-core is vulnerable to arbitrary file writes. The application does not properly check on the file path during extraction, allowing arbitrary files to be written in other directories...

PT-2018-9622 · Apache +3 · Plexis Archiver +3

Name of the Vulnerable Software and Affected Versions: plexus-archiver versions prior to 3.6.0 Description: The issue allows attackers to write to arbitrary files via a ../ dot dot slash in an archive entry that is mishandled during extraction. This is also known as 'Zip-Slip'. Recommendations: F...

PT-2018-1388 · Quazip +1 · Quazip +1

Name of the Vulnerable Software and Affected Versions: QuaZIP versions prior to 0.7.6 Description: The issue allows attackers to perform directory traversal, enabling them to write to arbitrary files by including a ../ dot dot slash in a Zip archive entry. This is also known as 'Zip-Slip'. The...

Arbitrary File Write

maven-core is vulnerable to arbitrary file writes. The application does not properly validate the destination filepath when during zip file extraction, allowing a malicious user to control the write destination and overwrite files...

Arbitrary File Write

Apache Storm is vulnerable to arbitrary file writes. The vulnerability exists due to the lack of sanitization of the filename, allowing path-traversal filenames to exist and write to arbitrary file locations during the unzipping process...

PT-2018-3087 · Apache +2 · Apache Zookeeper +2

Name of the Vulnerable Software and Affected Versions: Apache ZooKeeper versions 3.5.0-alpha through 3.5.3-beta Apache ZooKeeper versions prior to 3.4.10 Description: The issue arises from the lack of authentication when a server attempts to join a quorum in Apache ZooKeeper. This allows an...

Windows Exploitation Tricks: Exploiting Arbitrary File Writes for Local Elevation of Privilege

Posted by James Forshaw, Project Zero Previously I presented a technique to exploit arbitrary directory creation vulnerabilities on Windows to give you read access to any file on the system. In the upcoming Spring Creators Update RS4 the abuse of mount points to link to files as I exploited in th...

UBUNTU-CVE-2018-1000079

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to...

[ASA-201803-2] mkinitcpio-busybox: arbitrary code execution

Arch Linux Security Advisory ASA-201803-2 ========================================= Severity: High Date : 2018-03-01 CVE-ID : CVE-2017-16544 Package : mkinitcpio-busybox Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-514 Summary ======= The package...

[ASA-201803-1] busybox: arbitrary code execution

Arch Linux Security Advisory ASA-201803-1 ========================================= Severity: High Date : 2018-03-01 CVE-ID : CVE-2017-16544 Package : busybox Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-512 Summary ======= The package busybox before versi...

eQ-3 AG HomeMatic CCU2 Remote Code Execution Vulnerability

The eQ-3 AG Homematic CCU2 is a central control unit for controlling smart home devices from eQ-3 Germany. A remote code execution vulnerability exists in the addon installation process in eQ-3 AG Homematic CCU2 version 2.29.2 and earlier. An attacker could exploit the vulnerability to create or...

UBUNTU-CVE-2017-1000472

The ZipCommon::isValidPath function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does not properly restrict the filename value in the ZIP header, which allows attackers to conduct absolute path traversal attacks during the ZIP decompression, and possibly create or overwrite arbitrary...

CVE-2017-16544

It was found that the tab auto-completion feature of BusyBox did not sanitize filenames, leading to execution of arbitrary escape sequences in the terminal emulator. Exploitation of this flaw by an attacker could potentially result in code execution, arbitrary file writes, or other attacks under...

ALPINE-CVE-2017-16544

In the addmatch function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code...

CVE-2017-16544

In the addmatch function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code...

Design/Logic Flaw

In the addmatch function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code...

DEBIAN-CVE-2017-16544

In the addmatch function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code...

CVE-2017-16544

In the addmatch function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code...