Path Traversal in OWASP Dependency-Check

OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames...

GHSA-HCWX-7Q5V-VC67 Path Traversal in OWASP Dependency-Check

OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames...

RDF4J vulnerable to zip slip

RDF4J prior to 2.5.0 allows Directory Traversal via ../ in an entry in a ZIP archive...

GHSA-XRXM-MVQM-R553 Helm Path Traversal

All versions of Helm between Helm =2.0.0 and 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in The commands helm fetch --untar and helm lint some.tgz that can result when chart archive files are unpacked a file may be unpacked...

GHSA-F6FV-FJG8-4M6W OpenRefine Directory Traversal

OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive...

GHSA-3G56-2HH3-35PH SoSReport Predictable Tmp File Names

sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory, as demonstrated by sosreport-$hostname-$date.tar in /tmp/sosreport-$hostname-$date...

GHSA-2F6R-892P-69G5 GeniXCMS arbitrary PHP code execution

In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a theme...

GeniXCMS arbitrary PHP code execution

In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a theme...

au.net.causal.maven.plugins:docker-image-archive-maven-plugin (1.0), com.google.code.play2-maven-plugin:play2-maven-plugin (1.0.0-alpha9) +3 more potentially affected by CVE-2018-1002200 via org.codehaus.plexus:plexus-archiver (2.8.2)

org.codehaus.plexus:plexus-archiver MAVEN version 2.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-archiver and may be impacted: - au.net.causal.maven.plugins:docker-image-archive-maven-plugin 1.0 -...

com.github.jlgrock.javascript-framework:source-archive-maven-plugin (>=1.10.3, <=1.18.3), com.savage7.maven.plugins:maven-external-dependency-plugin (0.5) +2 more potentially affected by CVE-2018-1002200 via org.codehaus.plexus:plexus-archiver (1.1)

org.codehaus.plexus:plexus-archiver MAVEN version 1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-archiver and may be impacted: - com.github.jlgrock.javascript-framework:source-archive-maven-plugin =1.10.3, =2.2, =2.0.7,...

GHSA-QCF3-9VMH-XW4R Improper Limitation of a Pathname to a Restricted Directory in zt-zip

zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ dot dot slash in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'...

GHSA-98WX-CW86-C97X mixlib-archive Path Traversal vulnerability

Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using .. in tar archive entries...

Directory Traversal

Overview mixlib-archive is a simple interface to various archive formats Affected versions of this package are vulnerable to Directory Traversal allowing attackers to overwrite arbitrary files by supplying a filename for a tar archive involving ... Details A Directory Traversal attack also known ...

mixlib-archive Path Traversal vulnerability

Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using .. in tar archive entries...

GHSA-87VG-5PGX-PGGH spring-integration-zip Arbitrary File Write

Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal...

spring-integration-zip Arbitrary File Write

Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal...

mixlib-archive Path Traversal vulnerability

Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using .. in tar archive entries...

golang: archive/zip: Reader.Open panics on empty string

A vulnerability was found in archive/zip of the Go standard library. Applications written in Go where Reader.Open the API implementing io/fs.FS introduced in Go 1.16 can panic when parsing a crafted ZIP archive containing completely invalid names or an empty filename argument...

golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196)

A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic or potentially exhaust system memory when parsing malformed ZIP files. An attacker capable of submitting a crafted ZIP file to a Go application using archive/zip to process that file could...

cpio security update

An update is available for cpio. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The cpio packages provide the GNU cpio utility for creating and extracting...