Ansible: archive traversal vulnerability in ansible-galaxy collection install

An archive traversal flaw was found in Ansible Engine when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system...

CentOS 7 : samba (RHSA-2020:1084)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1084 advisory. - A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set i...

Directory Traversal

ansible is vulnerable to directory traversal. When extracting a collection of .tar.gz file, neither install nor the called extracttarfile performs any validation or sanitization of the filenames. This allows a malicious collection of .tar.gz file to be written in arbitrary location on the file...

GHSA-4G46-5GRC-WQ49 Cross-Site Scripting in seeftl

All versions of seeftl are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation No fix is currently available. Consider using a...

Cross-Site Scripting in seeftl

All versions of seeftl are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation No fix is currently available. Consider using a...

GHSA-GVR4-7XGC-GX3W Cross-Site Scripting in fileview

All versions of fileview are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation No fix is currently available. Consider using...

Cross-Site Scripting in fileview

All versions of fileview are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation No fix is currently available. Consider using...

GHSA-754X-4JWP-CQP6 Cross-Site Scripting in http_server

All versions of httpserver are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation No fix is currently available. Consider usi...

Vesta Control Panel Operating System Command Injection Vulnerability

Vesta Control Panel VestaCP is an open source web hosting control panel. An operating system command injection vulnerability exists in Vesta Control Panel VestaCP versions 0.9.8-26 and earlier, which can be exploited by an attacker to inject commands and execute code with the help of specially...

PT-2020-12225 · Opencart · Opencart

Name of the Vulnerable Software and Affected Versions: OpenCart version 3.0.3.2 Description: The issue allows remote authenticated users to conduct cross-site scripting XSS attacks by uploading an image with a crafted filename in the users' image upload section. Recommendations: For OpenCart...

Froxlor Denial of Service and Information Disclosure Vulnerability

Froxlor is a server administration control panel that can be used to manage multi-user or shared servers. A denial of service and information disclosure vulnerability exists in Froxlor versions prior to 0.10.14. The vulnerability stems from the fact that Froxlor creates files with static names in...

CVE-2014-4660

Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb...

GHSA-WP7M-MRVF-599C Command Injection in node-df

All versions of node-df are vulnerable to Command Injection. The package fails to sanitize filenames passed to the file option. If this value is user-controlled it may allow attackers to run arbitrary commands in the server. Recommendation No fix is currently available. Consider using an...

Huawei EulerOS: Security Advisory for audit (EulerOS-SA-2019-2385)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for gimp (EulerOS-SA-2019-2021)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross-Site Scripting

Overview All versions of fileview are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation No fix is currently available...

Cross-Site Scripting

Overview All versions of seeftl are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation No fix is currently available. Conside...

CVE-2019-19959

ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by for example valgrind...

MGASA-2020-0001 Updated apache-commons-compress- packages fix security vulnerability

pdated apache-commons-compress packages fix security vulnerability: A resource consumption vulnerability was discovered in apache-commons- compress in the way NioZipEncoding encodes filenames. Applications that use Compress to create archives, with one of the filenames within the archive being...

DEBIAN-CVE-2019-19959

ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by for example valgrind...