8690 matches found
CVE-2020-16116
In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal...
CVE-2020-16116
In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal...
Debian DSA-4738-1 : ark - security update
Dominik Penner discovered that the Ark archive manager did not sanitise extraction paths, which could result in maliciously crafted archives writing outside the extraction directory. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...
Ruby on Rails: XSS by file (Active Storage `Proxying`)
Hello, I've seen similar issues with 407319 and 429868 occur with Active Storage's new File serving strategies Proxying. Commit is https://github.com/rails/rails/commit/dfb5a82b259e134eac89784ac4ace0c44d1b4aee. ruby...
[SECURITY] [DSA 4738-1] ark security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4738-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 31, 2020 https://www.debian.org/security/faq -...
FreeBSD : ark -- directory traversal (d1ef1138-d273-11ea-a757-e0d55e2a8bf9)
KDE Project Security Advisory reports : KDE Project Security AdvisoryTitle:Ark: maliciously crafted archive can install files outside the extraction directory.Risk Rating:ImportantCVE:CVE-2020-16116Versions:ark Date:30 July 2020Overview A maliciously crafted archive with '../' in the file paths...
Commit Stream - OSINT Tool For Finding Github Repositories By Extracting Commit Logs In Real Time From The Github Event API
commit-stream drinks commit logs from the Github event firehose exposing the author details name and email address associated with Github repositories in real time. OSINT / Recon uses for Redteamers / Bug bounty hunters: Uncover repositories which employees of a target company is commiting code...
Mail.ru: tmgame.mail.ru - Blind sql injection
https://tmgame.mail.ru/action.php?xml=1&acode=comein&buildtype=all&bldID=selectfromselectsleep20a&bldlocID=8 bldID уязвимый get-параметор. Impact Получение данных из бд...
Unauthorized Access Vulnerability in Netcentric Cloud Devices of Shenzhen Netcentric Technology Co.
Shenzhen Netcenter Technology Co., Ltd, dedicated to the global shared computing and blockchain field, amplifies everyone's power through technological innovation. Shenzhen Netcentric Technology Co., Ltd Netcentric cloud devices have unauthorized access vulnerability, attackers can use the...
FreeXL: Multiple vulnerabilities
Background FreeXL is an open source library to extract valid data from within an Excel .xls spreadsheet. Description Multiple vulnerabilities have been discovered in FreeXL. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for...
SQL Injection Vulnerability in Extreme CMS of Langfang Extreme Network Technology Co. Ltd (CNVD-2020-48967)
Extreme CMS is an open source and free PHPCMS web content management system. Ltd. Extreme CMS suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...
Stack Overflow Vulnerability in Rexchip Microelectronics Corporation's Rexchip Microchip
Rexchip Microelectronics has a R&D team specializing in system-on-chip design and algorithm research, and provides professional chip solutions for high-end intelligent hardware, cell phone peripherals, tablet PCs, TV set-top boxes, industrial control, and many other fields. Rexchip Microelectroni...
openSUSE Security Update : file-roller (openSUSE-2020-825)
This update for file-roller fixes the following issues : - CVE-2020-11736: Fixed a directory traversal vulnerability due to improper checking whether a file's parent is an external symlink bsc1169428. - CVE-2019-16680: Fixed a path traversal vulnerability which could have allowed an overwriting o...
Steganographer - Hide Files Or Data In Image Files
This Module will hide files inside images currenlty PNG and export the modified image to disk The maximum size of file which can be hidden inside an image depends on the dimension of the image. maxfilesize = heightofimage widthofimage 6 / 8 bytes '100k words.txt' is hidden in 'originalimage.png'...
[SECURITY] Fedora 32 Update: podofo-0.9.6-11.fc32
PoDoFo is a library to work with the PDF file format. The name comes from the first letter of PDF Portable Document Format. A few tools to work with PDF files are already included in the PoDoFo package. The PoDoFo library is a free, portable C++ library which includes classes to parse PDF files a...
CVE-2020-15008
A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user...
CVE-2020-15008
A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user...
CVE-2020-15008
A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user...
Sql injection
A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user...
CVE-2020-15008
A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user...