10696 matches found
ant: excessive memory allocation when reading a specially crafted TAR archive
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected...
PT-2022-3981
Name of the Vulnerable Software and Affected Versions Apache Hadoop versions prior to 2.10.2 Apache Hadoop versions prior to 3.2.4 Apache Hadoop versions prior to 3.3.3 Description The issue is related to the FileUtil.unTarFile, File API in Apache Hadoop, which does not escape the input file name...
CVE-2022-31195 Path traversal vulnerability in Simple Archive Format package import in DSpace
DSpace open source software is a repository application which provides durable access to digital resources. In affected versions the ItemImportServiceImpl is vulnerable to a path traversal vulnerability. This means a malicious SAF simple archive format package could cause a file/directory to be...
CVE-2022-31195 Path traversal vulnerability in Simple Archive Format package import in DSpace
DSpace open source software is a repository application which provides durable access to digital resources. In affected versions the ItemImportServiceImpl is vulnerable to a path traversal vulnerability. This means a malicious SAF simple archive format package could cause a file/directory to be...
golang: compress/gzip: stack exhaustion in Reader.Read
A flaw was found in golang. Calling the Reader, Read method on an archive that contains a large number of concatenated 0-length compressed files can cause a panic issue due to stack exhaustion...
DSpace 路径遍历漏洞
DSpace is an open source turnkey repository application from the DuraSpace community. A path traversal vulnerability exists in DSpace versions 4.0 through 6.3, which stems from the intention that the SAF Simple Archive Format package could lead to the creation of files/directories in any location...
[SECURITY] Fedora 36 Update: golang-github-vbatts-tar-split-0.11.1-11.fc36
Pristinely disassembling a tar archive, and stashing needed raw bytes and offsets to reassemble a validating original archive...
Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits
The Microsoft Threat Intelligence Center MSTIC and the Microsoft Security Response Center MSRC found a private-sector offensive actor PSOA using multiple Windows and Adobe 0-day exploits, including one for the recently patched CVE-2022-22047, in limited and targeted attacks against European and...
Command Injection
git-archive is vulnerable to command injection. A local authenticated attacker is able to inject and execute malicious commands through the exports function in index.js...
lambda_pattern (>=0.0.15, <=0.0.31), push2cloud-cli (>=1.0.0, <=2.0.3) +3 more potentially affected by CVE-2020-28422 via git-archive (0.1.4)
git-archive NPM version 0.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on git-archive and may be impacted: - lambdapattern =0.0.15, =1.0.0, =1.0.0, =2.0.4 - push2cloud-compiler-rf 2.0.2 Source cves: CVE-2020-28422 Source advisory:...
GHSA-VQGR-MFXM-47F3 git-archive vulnerable to Command Injection via exports function
All versions of package git-archive are vulnerable to Command Injection via the exports function...
git-archive vulnerable to Command Injection via exports function
All versions of package git-archive are vulnerable to Command Injection via the exports function...
CVE-2020-28422
All versions of package git-archive are vulnerable to Command Injection via the exports function...
Command injection
All versions of package git-archive are vulnerable to Command Injection via the exports function...
CVE-2020-28422 Command Injection
All versions of package git-archive are vulnerable to Command Injection via the exports function...
CVE-2020-28422
CVE-2020-28422 affects the git-archive module, where the vulnerability is a command injection via the exports function . All versions are reported vulnerable, enabling a local attacker to execute arbitrary commands through the exports function. The issue has been consistently described across mul...
PT-2022-8885 · Unknown · Git-Archive
Name of the Vulnerable Software and Affected Versions: git-archive versions all Description: The issue concerns Command Injection via the exports function. This allows for potential execution of arbitrary commands. Recommendations: For all versions, consider disabling the exports function as a...
git-archive 命令注入漏洞
git-archive is a module by Noah Isaacson, an individual developer, that takes a bare git repo, archives it, and exports it as a tarball to a given path. A security vulnerability exists in git-archive that stems from easy command injection via the exports function...
GO-2022-0524 Stack exhaustion when reading certain archives in compress/gzip
Calling Reader.Read on an archive containing a large number of concatenated 0-length compressed files can cause a panic due to stack exhaustion...
About the security content of Security Update 2022-005 Catalina
About the security content of Security Update 2022-005 Catalina This document describes the security content of Security Update 2022-005 Catalina. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has...