OESA-2021-1188 gnome-autoar security update

Automatic archives creating and extracting library. Security Fixes: autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain...

CVE-2020-27833

A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by using a specially crafted raw container image .tar file which contains symbolic links. The vulnerability is limited to the command oc image extract. If a symbolic link is first...

IBM QRadar SIEM 路径遍历漏洞

QRadar SIEM is an IBM enterprise security information and event management product that consolidates log event and network flow data from thousands of devices, endpoints and applications scattered across the network. A path traversal vulnerability exists in the way IBM QRadar SIEM versions 7.3 an...

Huawei EulerOS: Security Advisory for file-roller (EulerOS-SA-2021-1783)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP3 : file-roller (EulerOS-SA-2021-1783)

According to the versions of the file-roller packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR...

Exploit for Incorrect Authorization in Moodle

Python script to exploit CVE-2020-14321https://moodle.org/mod...

PT-2021-14685 · Jenkins · Jenkins Config File Provider Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Config File Provider Plugin versions 3.7.0 and earlier Description: The issue allows attackers with the ability to define Maven configuration files to have Jenkins parse a crafted configuration file that uses external entities for...

VulnCheck KEV: CVE-2020-8260

Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction...

GPAC 代码问题漏洞

GPAC is a multimedia framework for rich media and distributed under the LGPL license. A null pointer dereference vulnerability exists in the gfisomsetextractionslc function in GPAC version 1.0.1. An attacker could exploit this vulnerability via specially crafted files to cause a denial of service...

GO-2020-0042 Arbitrary File Write via Archive Extraction (Zip Slip) in github.com/sassoftware/go-rpmutils

Due to improper path sanitization, RPMs containing relative file paths can cause files to be written or overwritten outside of the target directory...

GO-2021-0094 Directory traversal in github.com/hashicorp/go-slug

Protections against directory traversal during archive extraction can be bypassed by chaining multiple symbolic links within the archive. This allows a malicious attacker to cause files to be created outside of the target directory. Additionally if the attacker is able to read extracted files the...

GO-2020-0026 Arbitrary file write via archive extraction in github.com/openshift/source-to-image

Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

GO-2021-0099 Zip slip directory exploit in github.com/deislabs/oras

Due to improper path validation, using the github.com/deislabs/oras/pkg/content.FileStore content store may result in directory traversal during archive extraction, allowing a malicious archive to write paths to arbitrary paths that the process can write to...

Directory Traversal

file-roller is vulnerable to directory traversal. The fr-archive-libarchive.c module allows directory traversal during extraction as there is a lack of check of whether a file's parent is a symlink in certain complex situations. This issue exists due to an incomplete fix for CVE-2020-11736...

USN-4764-1: GLib vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description It was discovered that GLib incorrectly handled certain symlinks when replacing files. If a user or automated system were tricked into extracting a specially crafted file with File...

Columbo - A Computer Forensic Analysis Tool Used To Simplify And Identify Specific Patterns In Compromised Datasets

Columbo is a computer forensic analysis tool used to simplify and identify specific patterns in compromised datasets. It breaks down data to small sections and uses pattern recognition and machine learning models to identify adversaries behaviour and their possible locations in compromised Window...

DEBIAN-CVE-2020-36314

fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix...

Directory traversal

fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix...

OESA-2021-1108 gnome-autoar security update

Automatic archives creating and extracting library. Security Fixes: autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a...

GNOME file-roller 路径遍历漏洞

GNOME file-roller is a compressed file manager used in the GNOME desktop. A path traversal vulnerability exists in GNOME file-roller version 3.38.0 and prior versions, which stems from allowing directory traversal during extraction...