13193 matches found
PT-2022-24934 · Qtiworks · Qtiworks
Name of the Vulnerable Software and Affected Versions: QTIWorks versions prior to 1.0-beta15 Description: QTIWorks is a software suite for standards-based assessment delivery. The ZIP handling code does not sufficiently check the paths of files contained within ZIP files, allowing files to be...
PT-2022-26063 · Delta Electronics · Infrasuite Device Master
Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions 00.00.01a and prior Description: The issue concerns the mishandling of .ZIP archives containing characters used in path traversal, which could result in remote code execution. This path...
Delta Electronics InfraSuite Device Master path traversal vulnerability
Delta Electronics InfraSuite Device Master is used to simplify and automate the monitoring of critical equipment by Delta Electronics of Taiwan, China. A path traversal vulnerability exists in Delta Electronics InfraSuite Device Master 00.00.01a and prior versions, which stems from incorrectly...
Emotet Botnet Distributing Self-Unlocking Password-Protected RAR Files to Drop Malware
The notorious Emotet botnet has been linked to a new wave of malspam campaigns that take advantage of password-protected archive files to drop CoinMiner and Quasar RAT on compromised systems. In an attack chain detected by Trustwave SpiderLabs researchers, an invoice-themed ZIP file lure was foun...
Cisco Expressway Series Image Verification Code Execution
The vulnerability of the image verification function in devices controlled by Cisco Expressway Series and Cisco Telepresence VCS lies in the improper verification of the cryptographic signature. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by loading a maliciou...
Unbounded memory consumption when reading headers in archive/tar
...
Security Bulletin: Multiple vulnerabilities in Apache Ant affect IBM InfoSphere Information Server
Summary Multiple vulnerabilities in Apache Ant used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2021-36373 DESCRIPTION: Apache Ant is vulnerable to a denial of service, caused by an out-of-memory error when large amounts of memory are allocated. By...
AZL-11128 CVE-2022-2879 affecting package golang for versions less than 1.19.10-1
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB...
AZL-98895 CVE-2022-2879 affecting package golang 1.27.1-1
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB...
DEBIAN-CVE-2022-2879
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB...
UBUNTU-CVE-2022-2879
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB...
CVE-2022-2879 Unbounded memory consumption when reading headers in archive/tar
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB...
UBUNTU-CVE-2022-42906
powerline-gitstatus aka Powerline Gitstatus before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs gi...
Design/Logic Flaw
powerline-gitstatus aka Powerline Gitstatus before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs gi...
CVE-2022-42906
powerline-gitstatus aka Powerline Gitstatus before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs gi...
Powerline Gitstatus command injection vulnerability
Powerline Gitstatus is a library for displaying the status of Git working copies by the individual developer Jasper N. Brouwer. A security vulnerability exists in versions of powerline Gitstatus prior to 1.3.2 that originates from a vulnerability that allows arbitrary code execution. if an attack...
CVE-2022-42906
powerline-gitstatus aka Powerline Gitstatus before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs gi...
CVE-2022-42906
powerline-gitstatus aka Powerline Gitstatus before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs gi...
Google Golang Denial of Service Vulnerability
Google Golang is a statically strongly typed, compiled language from Google, Inc. Go's syntax is close to that of C, but differs for variable declarations. go supports garbage collection features. go's parallel model is based on Tony Hall's Communication Sequential Process CSP. other languages th...
