CVE-2021-23520

The package juce-framework/juce before 6.1.5 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip via the ZipFile::uncompressEntry function in juceZipFile.cpp. This vulnerability is triggered when the archive is extracted upon calling uncompressTo on a ZipFile object...

CVE-2021-23521

CVE-2021-23521 affects juce-framework/JUCE before 6.1.5. The vulnerability occurs when extracting a malicious archive containing a symbolic link: ZipFile::uncompressEntry can follow the link outside the target directory, allowing writing arbitrary files on the host and, in some cases, arbitrary c...

Arbitrary File Write

zip-local is vulnerable to arbitrary file write aka zip-slip vulnerability. The unsynchronously unzipping leads to extraction of a malicious file outside the intended extraction directory...

CVE-2021-23484

The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip which can lead to an extraction of a crafted file outside the intended extraction directory...

CVE-2021-23484

The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip which can lead to an extraction of a crafted file outside the intended extraction directory...

Directory traversal

The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip which can lead to an extraction of a crafted file outside the intended extraction directory...

CVE-2021-23484 Arbitrary File Write via Archive Extraction (Zip Slip)

The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip which can lead to an extraction of a crafted file outside the intended extraction directory...

CVE-2021-23484

The CVE-2021-23484 entry concerns the zip-local package prior to version 0.3.5, vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip). The issue enables extraction of crafted files outside the intended directory during archive extraction. This is documented across multiple sources ...

PT-2022-9401 · Zip-Local · Zip-Local

Name of the Vulnerable Software and Affected Versions: zip-local versions prior to 0.3.5 Description: The issue allows for Arbitrary File Write via Archive Extraction, also known as Zip Slip, which can lead to the extraction of a crafted file outside the intended extraction directory. This can...

Mageia: Security Advisory (MGASA-2018-0362)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-32840

SharpZipLib or ziplib is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry ../evil.txt may be extracted in the parent directory of destFolder. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3...

Remote code execution

SharpZipLib or ziplib is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry ../evil.txt may be extracted in the parent directory of destFolder. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3...

CVE-2021-32840

SharpZipLib or ziplib is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry ../evil.txt may be extracted in the parent directory of destFolder. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3...

Navidrome SQL Injection Vulnerability

Navidrome is a web-based open source music collection server and streamer. Used to freely listen to music collections from any browser or mobile device, a SQL injection vulnerability exists in versions of Navidrome prior to 0.47.5, which stems from a lack of validation of externally entered SQL...

SharpZipLib 路径遍历漏洞

SharpZipLib ziplib, formerly known as NZipLib is an open source C compression and decompression library from the ICSharpCode Icsharpcode team for the .NET platform, which supports decompression and compression of Zip, GZip, BZip2, Tar and other formats. A security vulnerability exists in...

DRUPAL-CONTRIB-2022-015

This module enables you to automatically scan images uploaded to the site to extract their meta data and store it in taxonomy structures. The module doesn't sufficiently protect against malicious files being used to attack the site. This vulnerability is mitigated by the fact that an attacker mus...

Exif - Critical - Remote code execution - SA-CONTRIB-2022-015

This module enables you to automatically scan images uploaded to the site to extract their meta data and store it in taxonomy structures. The module doesn't sufficiently protect against malicious files being used to attack the site. This vulnerability is mitigated by the fact that an attacker mus...

OESA-2022-1494 libarchive security update

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use . Security...

CVE-2021-23207

CVE-2021-23207 affects Fresenius Kabi Vigilant MasterMed 2.0.1.3. The documented issue allows an attacker with physical access to extract secrets from the device registry and create valid JWTs, enabling impersonation of arbitrary users and potential manipulation of RabbitMQ queues/messages. The r...

Samsung ActivityMetricsLogger Unauthorized Access Vulnerability

Samsung ActivityMetricsLogger is a progress measurement logger for Samsung mobile devices. An unauthorized access vulnerability exists in Samsung ActivityMetricsLogger that stems from an implicit intent hijacking scenario in ActivityMetricsLogger, which can be exploited by an attacker to obtain...