CVE-2024-45436

CVE-2024-45436 affects Ollama prior to 0.1.47, where extractFromZipFile in model.go can write ZIP entries outside the parent directory (Zip Slip/path traversal). The connected exploit document confirms a practical path traversal/vector in Ollama and notes exploitation could lead to arbitrary file...

Improper File Path Handling

unzip-stream is vulnerable to Improper File Path Handling. The vulnerability is due to the Extract method allowing malicious zip files to write to unauthorized paths...

PT-2024-40128 · Unknown · Unzip-Stream

Name of the Vulnerable Software and Affected Versions: unzip-stream versions prior to 0.3.2 Description: The issue allows malicious zip files to write to unauthorized paths when using the Extract method of unzip-stream. A researcher from Google, Justin Taft, discovered this issue. Recommendations...

CVE-2024-8088

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive for example, methods of "zipfile.Path" like "namelist", "iterdir", etc...

CVE-2024-8088

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive for example, methods of "zipfile.Path" like "namelist", "iterdir", etc...

MAL-2024-12316 Malicious code in oe-extract-ids (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bebbe22a538c4b7b6688bd82facdd749052e801663cf523c8d9c1eb11f81ea57 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in oe-extract-ids (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bebbe22a538c4b7b6688bd82facdd749052e801663cf523c8d9c1eb11f81ea57 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2024-41122 Custom environment variables allow to alter execution flow of plugins in Woodpecker

Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets w...

Path Traversal

@jmondi/url-to-png is vulnerable to Path Traversal. The vulnerability is due to the lack of proper sanitization or validation of the ImageId input within extractqueryparams.ts, which allows an attacker to store an image in an arbitrary location that the server has permission to access...

DEBIAN-CVE-2024-28820

Buffer overflow in the extractopenvpncr function in openvpn-cr.c in openvpn-auth-ldap aka the Three Rings Auth-LDAP plugin for OpenVPN 2.0.4 allows attackers with a valid LDAP username and who can control the challenge/response password field to pass a string with more than 14 colons into this...

Malicious code in Be.Vlaandеren.Basisregisters.PostalRegistry.Apі.Extract (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaaոderen.Basisregisters.BuildingRеgistry.Apі.Eхtract (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4214 Malicious code in Be.Vlaaոderen.Basisregisters.BuildingRеgistry.Apі.Eхtract (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaaոderen.Basisregisters.BuildingRеgistry.Api.Extract (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4213 Malicious code in Be.Vlaaոderen.Basisregisters.BuildingRеgistry.Api.Extract (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4215 Malicious code in Be.Vlaaոderen.Basisregisters.BuildiոgRegistry.Api.Extract.Abstractions (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaaոderen.Basisregisters.BuildiոgRegistry.Api.Extract.Abstractions (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaaոderen.Basisregisters.BuilԁiոgRegіstry.Api.Extract.Abstractions (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4216 Malicious code in Be.Vlaaոderen.Basisregisters.BuilԁiոgRegіstry.Api.Extract.Abstractions (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaaոderen.Basisrеgisters.ParcelRegistry.Aрi.Extraсt (NuGet)

--- -= Per source details. Do not edit below this line.=-...