PT-2019-12020 · Archive · Archiver

Name of the Vulnerable Software and Affected Versions: archiver versions all Description: The issue allows an attacker to perform a Zip Slip attack via the unarchive functions. This is exploited using a specially crafted zip archive that holds path traversal filenames. When exploited, a filename ...

CVE-2019-14866

It was discovered cpio does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to...

archives.lib.siu.edu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-998062 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Rubyzip Resource Management Error Vulnerability

Rubyzip is a Ruby library for reading and writing zip files. Rubyzip is vulnerable to a resource management error. An attacker can exploit this vulnerability to cause a denial of service disk consumption with the help of specially crafted ZIP files...

UBUNTU-CVE-2019-16892

In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service disk consumption...

FileThingie 2.5.7 - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: FileThingie 2.5.7 - Arbitrary File Upload Author: Cakes Vendor Homepage: www.solitude.dk/filethingie Software Link: https://github.com/leefish/filethingie/archive/master.zip Tested Version: 2.5.7 Tested on OS: CentOS 7 CVE: N/A...

PT-2019-4757 · Gnu +7 · Cpio +7

Name of the Vulnerable Software and Affected Versions: cpio versions prior to 2.13 Description: The issue is related to the improper validation of input files when generating TAR archives. This can lead to the creation of archives containing files with permissions or in paths that the attacker di...

Ubuntu 16.04 LTS / 18.04 LTS : NLTK vulnerability (USN-4106-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4106-1 advisory. Mike Salvatore discovered that NLTK mishandled crafted ZIP archives during extraction. A remote attacker could use this vulnerability to write arbitra...

USN-4106-1: NLTK vulnerability

Mike Salvatore discovered that NLTK mishandled crafted ZIP archives during extraction. A remote attacker could use this vulnerability to write arbitrary files to the filesystem...

USN-4106-1 NLTK vulnerability

Mike Salvatore discovered that NLTK mishandled crafted ZIP archives during extraction. A remote attacker could use this vulnerability to write arbitrary files to the filesystem...

The vulnerability of the IcedTea-Web plugin, related to an incorrect limitation on the path name to the restricted access catalog, allows a hacker to write arbitrary files to the device’s file system.

The vulnerability of the IcedTea-Web plugin is related to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to write arbitrary files to the device’s file system using a specially crafted file in formats: .tar, .jar, .war,...

CVE-2019-14771

CVE-2019-14771 affects Backdrop CMS: versions 1.12.x prior to 1.12.8 and 1.13.x prior to 1.13.3. The flaw lets an attacker upload entire-site configuration archives via the UI or CLI without validating archive contents, potentially permitting non-configuration scripts to be stored on the server. ...

CVE-2016-10792

cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives SEC-141...

CVE-2016-10792

cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives SEC-141...

CVE-2016-10792

cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives SEC-141...

CVE-2016-10792

CVE-2016-10792 affects cPanel prior to 59.9999.145. The vulnerability allows code execution in the context of other accounts via mailman list archives (SEC-141). This is the explicit impact described in connected references. The provided documents do not specify the exact vulnerable component or ...

unzip: Buffer overflow in list.c resulting in a denial of service

Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, because a buffer size is 10 and is supposed to be 12...

CVE-2017-18403

cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives SEC-337...

Code injection

cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives SEC-337...

CVE-2017-18403

CVE-2017-18403 affects cPanel prior to 68.0.15. The vulnerability allows code execution in the context of the nobody account via Mailman archives (SEC-337). Impact details in the provided documents indicate a potential compromise of systems running affected cPanel versions. The recommended remedi...