8707 matches found
CVE-2021-28650
CVE-2021-28650 affects GNOME gnome-autoar before 0.3.1, used by GNOME Shell, Nautilus, and other software. It allows Directory Traversal during extraction because it lacks a check of whether a file’s parent is a symlink in certain complex scenarios; this is noted as a follow‑up to CVE-2020-36241....
CVE-2021-28650
autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplet...
Gnome gnome-autoar 后置链接漏洞
Gnome gnome-autoar is a component of the Gnome community that provides widgets and gschemas functionality for GNOME applications. A backward linking vulnerability exists in GNOME gnome-autoar before 0.3.1 that allows traversing directories during extraction because, in some complex cases, it does...
Design/Logic Flaw
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client copy command to extract files outside the working path. The highest threat from this vulnerability is to integrity and...
CVE-2021-20218
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client copy command to extract files outside the working path. The highest threat from this vulnerability is to integrity and...
CVE-2021-20218
The CVE refers to fabric8 kubernetes-client vulnerability affecting version 4.2.0 and later, where a malicious pod/container can abuse the client’s copy command to extract files outside the working path, impacting integrity and availability. Fixed in kubernetes-client releases 4.13.2, 5.0.2, 4.11...
USN-4830-1 okular vulnerability
It was discovered that Okular mishandled certain crafted archives during extraction. An attacker could use this vulnerability to write arbitrary files to the filesystem...
CVE-2021-21367
Switchboard Bluetooth Plug for elementary OS from version 2.3.0 and before version version 2.3.5 has an incorrect authorization vulnerability. When the Bluetooth plug is running in discoverable mode, Bluetooth service requests and pairing requests are automatically accepted, allowing physically...
Authorization
Switchboard Bluetooth Plug for elementary OS from version 2.3.0 and before version version 2.3.5 has an incorrect authorization vulnerability. When the Bluetooth plug is running in discoverable mode, Bluetooth service requests and pairing requests are automatically accepted, allowing physically...
CVE-2021-21367 Incorrect Authorization in switchboard-plug-bluetooth
Switchboard Bluetooth Plug for elementary OS from version 2.3.0 and before version version 2.3.5 has an incorrect authorization vulnerability. When the Bluetooth plug is running in discoverable mode, Bluetooth service requests and pairing requests are automatically accepted, allowing physically...
DanielForé switchboard-plug-bluetooth 安全漏洞
DanielForé switchboard-plug-bluetooth is an open source application by DanielForé. A switchboard bluetooth plug. Switchboard Bluetooth suffers from a security vulnerability that would likely allow an attacker to extract data from such a service without authorization...
NewStart CGSL MAIN 6.02 : file-roller Multiple Vulnerabilities (NS-SA-2021-0068)
The remote NewStart CGSL host, running version MAIN 6.02, has file-roller packages installed that are affected by multiple vulnerabilities: - An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly...
django: Potential directory-traversal via archive.extract()
A flaw was found in django where thedjango.utils.archive.extract function, used by startapp --template and startproject --template, allowed directory-traversal via an archive with absolute paths or relative paths with dot segments...
Microsoft Exchange Hackers Also Breached European Banking Authority
The European Banking Authority EBA on Sunday said it had been a victim of a cyberattack targeting its Microsoft Exchange Servers, forcing it to temporarily take its email systems offline as a precautionary measure. "As the vulnerability is related to the EBA's email servers, access to personal da...
Ubuntu: Security Advisory (USN-4733-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Siemens Solid Edge File Parsing
1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Siemens Equipment: Solid Edge Vulnerabilities: Out-of-bounds Write, Improper Restriction of XML External Entity Reference, Out-of-bounds Read 2. RISK EVALUATION Successful exploitation of these vulnerabilities could...
USN-4733-2: GNOME Autoar regression
USN-4733-1 fixed a vulnerability in GNOME Autoar. The upstream fix introduced a regression when extracting archives containing directories. This update fixes the problem. Original advisory details: Yiğit Can Yılmaz discovered that GNOME Autoar could extract files outside of the intended directory...
USN-4733-2 gnome-autoar regression
USN-4733-1 fixed a vulnerability in GNOME Autoar. The upstream fix introduced a regression when extracting archives containing directories. This update fixes the problem. Original advisory details: Yiğit Can Yılmaz discovered that GNOME Autoar could extract files outside of the intended directory...