[ASA-201801-17] zziplib: denial of service

Arch Linux Security Advisory ASA-201801-17 ========================================== Severity: Medium Date : 2018-01-18 CVE-ID : CVE-2017-5977 CVE-2017-5978 Package : zziplib Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-273 Summary ======= The package zziplib...

Skybox Platform Remote Code Execution Vulnerability

Skybox PlatformAn enterprise-grade network security management platform from US-based Skybox Security. The platform features attack vector analysis, firewall management, vulnerability and threat management, and more. A remote code execution vulnerability exists in Skybox Platform versions prior t...

CVE-2014-9485

Directory traversal vulnerability in the doextractcurrentfile function in miniunz.c in miniunzip in minizip before 1.1-5 might allow remote attackers to write to arbitrary files via a crafted entry in a ZIP archive...

CVE-2014-9485

Directory traversal vulnerability in the doextractcurrentfile function in miniunz.c in miniunzip in minizip before 1.1-5 might allow remote attackers to write to arbitrary files via a crafted entry in a ZIP archive...

Directory traversal

Directory traversal vulnerability in the doextractcurrentfile function in miniunz.c in miniunzip in minizip before 1.1-5 might allow remote attackers to write to arbitrary files via a crafted entry in a ZIP archive...

CVE-2014-9485

Directory traversal vulnerability in the doextractcurrentfile function in miniunz.c in miniunzip in minizip before 1.1-5 might allow remote attackers to write to arbitrary files via a crafted entry in a ZIP archive...

CVE-2014-9485

CVE-2014-9485 is a directory traversal vulnerability in the minizip component (miniunz.c: do_extract_currentfile) where minizip before 1.1-5 could allow writing to arbitrary files via a crafted ZIP entry. Affected software is the minizip/miniunz.c workflow; exploitation would enable an attacker t...

CVE-2014-9485

Directory traversal vulnerability in the doextractcurrentfile function in miniunz.c in miniunzip in minizip before 1.1-5 might allow remote attackers to write to arbitrary files via a crafted entry in a ZIP archive...

CVE-2014-9485

Directory traversal vulnerability in the doextractcurrentfile function in miniunz.c in miniunzip in minizip before 1.1-5 might allow remote attackers to write to arbitrary files via a crafted entry in a ZIP archive...

Code injection

An issue was discovered in Skybox Platform before 7.5.201. Remote Unauthenticated Code Execution exists via a WAR archive containing a JSP file. The WAR file is sent to /skyboxview-softwareupdate/services/CollectorSoftwareUpdate and the JSP file is reached at...

CVE-2015-9246

CVE-2015-9246 affects Skybox Platform; remote unauthenticated code execution via a WAR containing a JSP is possible. The WAR is delivered to /skyboxview-softwareupdate/services/CollectorSoftwareUpdate and the JSP executes at /opt/skyboxview/thirdparty/jboss/server/web/work/jboss.web/localhost. Af...

CVE-2017-2158

Improper verification when expanding ZIP64 archives in Lhaplus versions 1.73 and earlier may lead to unintended contents to be extracted from a specially crafted ZIP64 archive...

The vulnerability of the phar_parse_pharfile function (ext/phar/phar.c), a PHAR archive handler, allows a attacker to cause a service failure.

The vulnerability of the pharparsepharfile function ext/phar/phar.c, a PHAR archive handler, arises due to the execution of an operation beyond the buffer’s boundaries in memory. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures using a...

The vulnerability of the libarchive library, which exists due to a resource management error, allows a hacker to cause a service failure.

The vulnerability of the libarchive library exists due to a resource management flaw—the absence of limits on the number of archives that can be decompressed. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause service failures by using a specially created gz...

JVN#57842148: Lhaplus vulnerable to improper verification when expanding ZIP64 archives

Lhaplus is file compression/decompression software. Lhaplus does not treat ZIP64 archives properly when expanding. Impact An unintended content may be extracted from a crafted ZIP64 archive. Solution Update the Software Update to the latest version according to the information provided by the...

WordPress Download Manager 2.9.60 Cross Site Request Forgery

Exploit Title: WordPress Download Manager CSRF Discovery Date: 2017-12-12 Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: https://www.wpdownloadmanager.com/ Software Link: https://wordpress.org/plugins/download-manager Version: 2.9.60 Tested on:...

WordPress Download Manager 2.9.60 Plugin - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress Download Manager CSRF Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: https://www.wpdownloadmanager.com/ Software Link: https://wordpress.org/plugins/download-manager...

Updated libzip packages fix security vulnerability

The zipreadeocd64 function mishandled EOCD records, which allowed remote attackers to cause a denial of service memory allocation failure in zipcdirgrow in zipdirent.c via a crafted ZIP archive CVE-2017-14107...

Chrome Extension with 105,000 installs is a Cryptocurrency Miner

By Waqas Archive Poster extension for Chrome browser is being currently used by 105,000 This is a post from HackRead.com Read the original post: Chrome Extension with 105,000 installs is a Cryptocurrency Miner...

Change Healthcare Conserus Image Repository archive solution XML External Entity Injection Vulnerability

Change Healthcare Conserus Image Repository archive solution is a medical diagnostic image storage solution from Change Healthcare, USA. An XML external entity injection vulnerability exists in Change Healthcare Conserus Image Repository archive solution version 2.1.1.105. A remote attacker can...