10696 matches found
CVE-2022-44748 Uploading workflows to KNIME Server may override arbitrary file system contents
A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. This vulnerability is also known as 'Zip-Slip'. An attacker can create a KNIME workflow that, when being uploaded, ca...
CVE-2022-44748
CVE-2022-44748 - KNIME Server Zip-Slip directory traversal . A vulnerability in KNIME Server’s ZIP archive extraction routines allows an authenticated user (with upload rights) to overwrite arbitrary files on the server’s filesystem. The root cause is directory traversal during workflow upload, e...
PT-2022-27299 · Knime · Knime Analytics Platform
Name of the Vulnerable Software and Affected Versions: KNIME Analytics Platform versions 3.2.0 and above Description: A directory traversal vulnerability in the ZIP archive extraction routines can result in arbitrary files being overwritten on the user's system, also known as 'Zip-Slip'. An...
Knime Server 路径遍历漏洞
Knime Server is enterprise software for putting data science workflows into production from Knime Switzerland. A security vulnerability exists in Knime Server prior to version 4.15.3, which stems from a directory traversal vulnerability in the ZIP archive extraction routines that could lead to th...
CVE-2022-41935
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users without the right to view documents can deduce their existence by repeated Livetable queries. The issue has been patched in XWiki 14.6RC1, 13.10.8, and 14.4.3, the response is not proper...
Design/Logic Flaw
xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection'. Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper...
CVE-2022-41935 Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-ui
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users without the right to view documents can deduce their existence by repeated Livetable queries. The issue has been patched in XWiki 14.6RC1, 13.10.8, and 14.4.3, the response is not proper...
Maarch RM 授权问题漏洞
Maarch RM is an electronic filing system from Maarch. Streamline your certification processes, scientific and technical control in an efficient and optimized way. An information disclosure vulnerability exists in Maarch RM 2.8 and later, versions prior to 2.8.6, and 2.9. The vulnerability stems...
CVE-2022-41931 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui
xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection'. Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper...
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-menu-ui
Impact Any user with view rights on commonly accessible documents including the menu macro can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation due to improper escaping of the macro content and parameters of the menu macro. The issue can ...
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui
Impact Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper neutralization of the macro parameters of the icon picker macro. The URL...
golang: compress/gzip: stack exhaustion in Reader.Read
A flaw was found in golang. Calling the Reader, Read method on an archive that contains a large number of concatenated 0-length compressed files can cause a panic issue due to stack exhaustion...
CVE-2022-37290
GNOME Nautilus 42.2 allows a NULL pointer dereference and getbasename application crash via a pasted ZIP archive...
CVE-2022-37290
GNOME Nautilus 42.2 allows a NULL pointer dereference and getbasename application crash via a pasted ZIP archive...
CVE-2022-37290
GNOME Nautilus 42.2 allows a NULL pointer dereference and getbasename application crash via a pasted ZIP archive...
UBUNTU-CVE-2022-37290
GNOME Nautilus 42.2 allows a NULL pointer dereference and getbasename application crash via a pasted ZIP archive...
Null pointer dereference
GNOME Nautilus 42.2 allows a NULL pointer dereference and getbasename application crash via a pasted ZIP archive...
CVE-2022-37290
GNOME Nautilus 42.2 allows a NULL pointer dereference and getbasename application crash via a pasted ZIP archive...
CVE-2022-37290
CVE-2022-37290 affects GNOME Nautilus (GNOME Nautilus 42.2) and is triggered by pasting a crafted ZIP archive, causing a NULL pointer dereference and an application crash. The vulnerability is exploitable locally with low privileges and no user interaction required, per the CVSS data. Several con...
