EUVD-2022-3393

Malicious code in bioql PyPI...

com.alibaba.oneagent:one-java-agent (0.0.1) potentially affected by CVE-2022-25842 via com.alibaba.oneagent:one-java-agent-plugin (0.0.1)

com.alibaba.oneagent:one-java-agent-plugin MAVEN version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.oneagent:one-java-agent-plugin and may be impacted: - com.alibaba.oneagent:one-java-agent 0.0.1 Source cves: CVE-2022-25842 Sourc...

CVE-2022-25842

All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip using a specially crafted archive that holds directory traversal filenames e.g. ../../evil.exe. The attacker can overwrite executable files and either invoke...