CVE-2020-7667

In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all...

Design/Logic Flaw

In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all...

CVE-2020-7667

In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all...

CVE-2020-7667: Improper Limitation of a Pathname to a Restricted Directory

In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all...

CVE-2020-7664

In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

github.com Improper Access Control vulnerability OBB-1202505

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-7668

In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

CVE-2020-7664 Arbitrary File Write via Archive Extraction (Zip Slip)

In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

CVE-2020-7664

In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

CVE-2020-7664

The CVE-2020-7664 issue affects the Go package github.com/unknwon/cae/zip, specifically the ExtractTo function. The vulnerability arises because ExtractTo does not securely escape file paths in zip archives that contain leading or non-leading “..”, enabling path traversal that could allow an atta...

CVE-2020-7668: Improper Limitation of a Pathname to a Restricted Directory

In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

CVE-2020-7664: Improper Limitation of a Pathname to a Restricted Directory

In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

filmlondon.org.uk Cross Site Scripting vulnerability OBB-1194083

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Insecure Access Control

github.com/hashicorp/consul uses an insecure access control. The scope of local and global tokens are not properly enforced, allowing local ACL tokens to be used in other data centers...

Spyeye - Script To Generate Win32 .Exe File To Take Screenshots

Script to generate Win32 .exe file to take screenshots every 10 seconds. Features: Works on WAN: Port Forwarding by Serveo.net Fully Undetectable FUD - Don't Upload to virustotal.com! Legal disclaimer: Usage of SpyEye for attacking targets without prior mutual consent is illegal. It's the end...

Denial Of Service (DoS)

github.com/apache/thrift is vulnerable to denial of service DoS. The vulnerability exists because it does not properly handle unexpected data despite there was a partial fix, allowing an attacker to send malicious payloads to trigger an application crash...

Unauthorized Access

github.com/openshift/cluster-kube-apiserver-operator allows unauthorized access. Users with access to create pods also have the ability to schedule workloads on master nodes. Pods with permission to access the host network, running on master nodes, can retrieve security credentials for the master...

Open Redirection

github.com/go-macaron/macaron is vulnerable to open redirection. Lack of validation of the path URL allows a remote attacker to redirect users to a malicious site to steal user credentials...

Improper Access Control

github.com/gorilla/handlers is vulnerable to improper access control. The vulnerability exists because it does not perform sufficient origin header access checks due to the misconfiguration of CORS, allowing an attacker to send malicious AJAX requests or HTML Document through it bypassing the sam...

Denial Of Service (DoS)

github.com/go-yaml/yaml is vulnerable to denial of service. An authorized user is able to crash the application by sending malicious YAML payloads to cause kube-apiserver to consume excessive CPU cycles...