SUSE-SU-2018:1883-1 Security update for unzip

This update for unzip fixes the following issues: - CVE-2014-9636: Prevent denial of service out-of-bounds read or write and crash via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression bsc914442 -...

USN-3699-1: zziplib vulnerabilities

It was discovered that zziplib incorrectly handled certain malformed ZIP files. If a user or automated system were tricked into opening a specially crafted ZIP file, a remote attacker could cause zziplib to crash, resulting in a denial of service, or possibly execute arbitrary code...

DEBIAN-CVE-2018-10860

perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary...

PT-2018-8956 · Microsoft · Windows +1

Name of the Vulnerable Software and Affected Versions: Microsoft Windows affected versions not specified Description: The issue concerns an untrusted search path vulnerability in self-extracting archive files created by IExpress, which is bundled with Microsoft Windows. This vulnerability allows ...

Subdomain Discovery Tool: SubFinder

SubFinder is a subdomain discovery tool that uses various techniques to discover massive amounts of subdomains for any target. It has been aimed as a successor to the sublist3r project . SubFinder uses Passive Sources, Search Engines, Pastebins, Internet Archives, etc to find subdomains and then ...

Search Secrets in Various File Types: DumpsterDiver

DumpsterDiver is a tool used to analyze big volumes of various file types in search of hardcoded secret keys e.g. AWS Access Key, Azure Share Key or SSH keys based on counting the entropy. Additionally, it allows creating a simple search rules with basic conditions e.g. reports only csv file...

Ex-CIA employee charged with leaking 'Vault 7' hacking tools to Wikileaks

A 29-year-old former CIA computer programmer who was charged with possession of child pornography last year has now been charged with masterminding the largest leak of classified information in the agency's history. Joshua Adam Schulte, who once created malware for both the CIA and NSA to break...

PT-2018-1388 · Quazip +1 · Quazip +1

Name of the Vulnerable Software and Affected Versions: QuaZIP versions prior to 0.7.6 Description: The issue allows attackers to perform directory traversal, enabling them to write to arbitrary files by including a ../ dot dot slash in a Zip archive entry. This is also known as 'Zip-Slip'. The...

CVE-2017-5443

An out-of-bounds write vulnerability while decoding improperly formed BinHex format archives. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

CVE-2017-5443

An out-of-bounds write vulnerability while decoding improperly formed BinHex format archives. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

The vulnerability of the diffoscope file and directory comparison tool lies in the lack of necessary checks during the analysis of archives. This allows a malicious actor to write data into arbitrary areas of disk space.

The vulnerability of the diffoscope file and directory comparison tool lies in the lack of necessary checks during the analysis of archives. Exploiting this vulnerability allows a malicious actor, operating remotely, to write data to arbitrary areas of disk space using a specially crafted archive...

DumpsterDiver - Tool To Search Secrets In Various Filetypes

DumpsterDiver is a tool used to analyze big volumes of various file types in search of hardcoded secret keys e.g. AWS Access Key, Azure Share Key or SSH keys. Additionally, it allows creating a simple search rules with basic conditions e.g. reports only csv file including at least 10 email...

metal-archives.com XSS vulnerability

Open Bug Bounty ID: OBB-626557 Description| Value ---|--- Affected Website:| metal-archives.com Open Bug Bounty Program:| View Open Bug Bounty Program Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-11196

Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 can be used as medium to transmit viruses by placing infected files into a Leap2A archive and uploading that to Mahara. In contrast to other ZIP files that are uploaded, ClamAV when activated does not check Leap2A...

CVE-2018-11196

Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 can be used as medium to transmit viruses by placing infected files into a Leap2A archive and uploading that to Mahara. In contrast to other ZIP files that are uploaded, ClamAV when activated does not check Leap2A...

Self-Extracting Archive files created by IExpress may insecurely load Dynamic Link Libraries

Overview Self-extracting archive files created by IExpress provided Microsoft contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Microsoft states that the root cause of this vulnerability is "Application Directory App Dir DLL planting"...

Pivotal Spring-integration-zip Arbitrary File Write Vulnerability

Pivotal Spring-integration-zip is a U.S. Pivotal Software, Inc. used in Spring in the compression/decompression components. An arbitrary file write vulnerability exists in Pivotal Spring-integration-zip versions prior to 1.0.1. The vulnerability can be exploited to write arbitrary files with a...

CVE-2018-1261

Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z that holds path traversal filenames. So when the filename gets concatenated to th...

WordPress has an arbitrary file upload vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. WordPress has an arbitrary file upload vulnerability. The vulnerability is due to the system does not filter the content of t...

7-Zip Remote Code Execution Vulnerability

7-Zip is a free, open source compression/decompression software. A security vulnerability exists in 7-Zip version 18.03 and earlier, which stems from faulty initialization logic in the program. A remote attacker can exploit this vulnerability to cause a denial of service segmentation error or...