Mozilla: Lack of warning when opening Diagcab files

The Mozilla Foundation Security Advisory describes this flaw as: When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code...

Internet Explorer help

None None...

WordPress Cab Grid Plugin <= 1.5.15 is vulnerable to Cross Site Scripting (XSS)

Software Cab Grid Type Plugin Vulnerable versions = 1.5.15 Fixed in 1.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28533 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b5fcc0bdddbf Credits Yuki Haruma Required privilege...

SUSE CVE-2005-3500

The tnefattachment function in tnef.c for Clam AntiVirus ClamAV before 0.87.1 allows remote attackers to cause a denial of service infinite loop and memory exhaustion via a crafted value in a CAB file that causes ClamAV to repeatedly scan the same block...

SUSE CVE-2005-3501

The cabdfind function in cabd.c of the libmspack library mspack for Clam AntiVirus ClamAV before 0.87.1 allows remote attackers to cause a denial of service infinite loop via a crafted CAB file that causes cabdfind to be called with a zero length...

SUSE CVE-2010-0098

ClamAV before 0.96 does not properly handle the 1 CAB and 2 7z file formats, which allows remote attackers to bypass virus detection via a crafted archive that is compatible with standard archive utilities...

SUSE CVE-2010-4666

Buffer overflow in libarchive 3.0 pre-release code allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted CAB file, which is not properly handled during the reading of Huffman code data within LZX compressed data...

SUSE CVE-2014-9556

Integer overflow in the qtmddecompress function in libmspack 0.4 allows remote attackers to cause a denial of service hang via a crafted CAB file, which triggers an infinite loop...

SUSE CVE-2014-9732

The cabdextract function in cabd.c in libmspack before 0.5 does not properly maintain decompression callbacks in certain cases where an invalid file follows a valid file, which allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted CAB...

SUSE CVE-2015-0552

Directory traversal vulnerability in the gcabfolderextract function in libgcab/gcab-folder.c in gcab 0.4 allows remote attackers to write to arbitrary files via crafted path in a CAB file, as demonstrated by "\tmp\moo."...

SUSE CVE-2015-4470

Off-by-one error in the inflate function in mszipd.c in libmspack before 0.5 allows remote attackers to cause a denial of service buffer over-read and application crash via a crafted CAB archive...

SUSE CVE-2015-4471

Off-by-one error in the lzxddecompress function in lzxd.c in libmspack before 0.5 allows remote attackers to cause a denial of service buffer under-read and application crash via a crafted CAB archive...

SUSE CVE-2015-8917

bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service NULL pointer dereference and crash via an invalid character in the name of a cab file...

SUSE CVE-2015-8918

The archivestringappend function in archivestring.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service crash via a crafted cab files, related to "overlapping memcpy."...

SUSE CVE-2017-11423

The cabdreadstring function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2 and other products, allows remote attackers to cause a denial of service stack-based buffer over-read and application crash via a crafted CAB file...

SUSE CVE-2018-5345

A stack-based buffer overflow within GNOME gcab through 0.7.4 can be exploited by malicious attackers to cause a crash or, potentially, execute arbitrary code via a crafted .cab file...

SUSE CVE-2018-18584

In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write...

Internet Explorer help

None None...

Earth Bogle Campaign Unleashes NjRAT Trojan on Middle East and North Africa

An ongoing campaign dubbed Earth Bogle is leveraging geopolitical-themed lures to deliver the NjRAT remote access trojan to victims across the Middle East and North Africa. "The threat actor uses public cloud storage services such as files.fm and failiem.lv to host malware, while compromised web...

cab-com.com Cross Site Scripting vulnerability OBB-2995103

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...