13108 matches found
Arbitrary File Write via Archive Extraction (Zip Slip)
Overview Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip via the parseFromZipFile function, which will copy the file in zip to a temporary directory without verifying the file path, and the file can be written to an arbitrary path. Details ...
Medium: golang
Issue Overview: The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip...
Medium: golang
Issue Overview: The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip...
Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files
...
GO-2024-2450 Mattermost viewing archived public channels permissions vulnerability in github.com/mattermost/mattermost-server
Mattermost viewing archived public channels permissions vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
OESA-2024-1769 golang security update
The Go Programming Language. Security Fixes: The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading t...
OESA-2024-1772 golang security update
The Go Programming Language. Security Fixes: The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading t...
OESA-2024-1771 golang security update
The Go Programming Language. Security Fixes: The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading t...
GHSA-MR7H-W2QC-FFC2 pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the pluginserver, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path...
CVE-2024-36075: Improper Control of Generation of Code
The CoSoSys Endpoint Protector through 5.9.3 and Unify agent through 7.0.6 is susceptible to an arbitrary code execution vulnerability due to the way an archive obtained from the Endpoint Protector or Unify server is extracted on the endpoint. An attacker who is able to modify the archive on the...
Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server Liberty and libcurl may affect IBM Storage Protect Backup-Archive Client
Summary IBM Storage Protect Backup-Archive Client can be affected by security flaws in IBM WebSphere Application Server Liberty and libcurl. The flaws can lead to weaker than expected security for outbound TLS connections and bypass of security restrictions, as described in the "Vulnerability...
MAL-2024-6672 Malicious code in archive-uploader (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-6671 Malicious code in archive-lister (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in archive-lister (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in archive-uploader (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in Be.Vlaanderen.Basisregіsters.RoadRegistrу.BackOffice.ZiрArchiveWrіters (NuGet)
--- -= Per source details. Do not edit below this line.=-...
June 25, 2024—KB5039302 (OS Builds 22621.3810 and 22631.3810) Preview
June 25, 2024—KB5039302 OS Builds 22621.3810 and 22631.3810 Preview Applies To Windows 11 version 22H2, all editions Windows 11 version 23H2, all editions Note For information about Windows update terminology, see the article about the types of Windows updates and the monthly quality update types...
CVE-2024-33880
An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. It discloses full pathnames via Virto.SharePoint.FileDownloader/Api/Download.ashx?action=archive...
OpenCart File Leakage Vulnerability
OpenCart is an open source online store management system for creating and managing e-commerce websites. It is known for its user-friendliness and flexibility for online stores of different sizes. OpenCart suffers from a file disclosure vulnerability due to an improperly cleaned destination path...
PT-2024-25527
Name of the Vulnerable Software and Affected Versions VirtoSoftware Virto Bulk File Download version 5.5.44 for SharePoint 2019 Description The issue discloses full pathnames via the "Virto.SharePoint.FileDownloader/Api/Download.ashx?action=archive" API endpoint. Recommendations For VirtoSoftware...