OESA-2022-1518 golang security update

The Go Programming Language. Security Fixes: In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header Falsely designating that many files are present can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for...

CVE-2021-40837

A vulnerability affecting F-Secure antivirus engine before Capricorn update 2022-02-0101 was discovered whereby decompression of ACE file causes the scanner service to stop. The vulnerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the...

CVE-2022-24676

updatecode in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive...

CVE-2022-24676

updatecode in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive...

Design/Logic Flaw

updatecode in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive...

AlmaLinux 8 : python3 (ALSA-2020:4433)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4433 advisory. - The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the servertitle field. This occurs in...

HYBBS code-related vulnerabilities

HYBBS is a lightweight community forum program. A code issue vulnerability exists in HYBBS2, which stems from the product Admin.php page not checking for uploaded files during updates. An attacker can use this vulnerability to upload a carefully crafted ZIP archive file. The following products an...

F-Secure antivirus engine security vulnerability

F-secure F-Secure antivirus engine is a security engine from the Finnish company F-Secure F-secure. A security vulnerability exists in F-Secure antivirus engine, which originates from the decompression of an ACE file that causes the scanner service to stop. An attacker can remotely exploit the...

CVE-2022-24676

updatecode in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive...

CVE-2022-24676

CVE-2022-24676 affects HYBBS2 up to version 2.3.2, where the update_code flow in Admin.php allows arbitrary file upload via a crafted ZIP archive. The root cause is described as the Admin.php page not validating uploaded files during updates, enabling potential file upload abuse. Public reference...

CVE-2022-24676

updatecode in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive...

PT-2022-16793

Name of the Vulnerable Software and Affected Versions HYBBS2 versions 2.3.2 and earlier Description The issue allows for arbitrary file upload via a crafted ZIP archive. This is possible due to a problem in the update code function in Admin.php. Recommendations For HYBBS2 versions 2.3.2 and...

CVE-2022-24676: Unrestricted Upload of File with Dangerous Type

updatecode in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive...

Iranian state-sponsored APT group MuddyWater targeting organizations via malicious executables

THREAT LEVEL: Red. United States Cyber Command USCYBERCOM has warned of an ongoing cyber attack by Iranian state sponsored actor named as MuddyWater. This APT group is currently targeting Middle Eastern countries and has also targeted European and North American nations. The Iranian-backed...

CVE-2022-24262

The config restore function of Voipmonitor GUI before v24.96 does not properly check files sent as restore archives, allowing remote attackers to execute arbitrary commands via a crafted file in the web root...

golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196)

A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic or potentially exhaust system memory when parsing malformed ZIP files. An attacker capable of submitting a crafted ZIP file to a Go application using archive/zip to process that file could...

Remote Code Execution (RCE)

w-zip is vulnerable to remote code execution. The vulnerability exists due to an insecure output path in the archive extraction zip slip function...

CVE-2022-23596

Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem ...

CVE-2022-23596

Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem ...

CVE-2022-23596

Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem ...