GHSA-FX2V-QFHR-4CHV Goutil vulnerable to path traversal when unzipping files

Impact ZipSlip issue when use fsutil package to unzip files. When users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. Patches It has been fixed in v0.6.0, Please upgrade version to v0.6.0 or above. Workarounds No, users have to upgrade...

Path traversal

Goutil is a collection of miscellaneous functionality for the go language. In versions prior to 0.6.0 when users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. This vulnerability is known as a ZipSlip. This issue has been fixed in version...

CVE-2023-27475 Goutil vulnerable to path traversal when unzipping files

Goutil is a collection of miscellaneous functionality for the go language. In versions prior to 0.6.0 when users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. This vulnerability is known as a ZipSlip. This issue has been fixed in version...

Attacker contract can avoid being blocked

Lines of code Vulnerability details Impact A Malicious attacker can interact with the system and selfdestruct his own contract then use CREATE2 to recreate it at same address when he needs to interact with the system again. Proof of Concept Tools Used Manual Review Recommended Mitigation Steps...

Broken Cryptographic Algorithm

gradle is vulnerable to Broken Cryptographic Algorithm. The vulnerability allows a malicious attacker to replace a legitimate artifact with a different one with the same SHA-1 digest...

K23432927: The BIG-IP ASM system may redirect a client request to an incorrect URL

Security Advisory Description The BIG-IP ASM system may redirect a client request to an incorrect URL after the client browser passes the client-side integrity defense JavaScript challenge. This issue occurs when all of the following conditions are met: You have enabled the Client Side Integrity...

CVE-2022-48282 Deserializing compromised object with MongoDB .NET/C# Driver may cause remote code execution

Under very specific circumstances see Required configuration section below, a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C. This affects all MongoDB .NET/C Driver versions prior to and...

SUSE CVE-2020-12988

A potential denial of service DoS vulnerability exists in the integrated chipset that may allow a malicious attacker to hang the system when it is rebooted...

CVE-2023-22418 BIG-IP APM virtual server vulnerability

On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows an unauthenticated malicious attacker t...

Integer Overflow

vlc is vulnerable to integer overflows. The vulnerability exists through the VNC module via tricking a user into opening a crafted playlist or connecting to a rogue VNC server, which allows a malicious attacker to cause integer overflows...

XWiki Platform 安全漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the French company XWiki. A security vulnerability exists in XWiki Platform xwiki-platform-user-profile-ui version 12.4 and later. An attacker could exploit this vulnerability to enable or disable any use...

CVE-2022-23748

mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In these scenarios, a malicious attacker could be using the valid and legitimate executable to load malicious files...

CVE-2022-23748

mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In these scenarios, a malicious attacker could be using the valid and legitimate executable to load malicious files...

Cross-site Request Forgery (CSRF)

rdiffweb is vulnerable to cross-site request forgery. The vulnerability exists in default function of pagesettings.py because the repository settings changes are not properly restricted which allows a malicious attacker to change the setting of the repository by sending the URL to the victim...

Out-of-bound Read

vim is vulnerable to out-of-bound read vulnerability. The vulnerability exists in the checkvim9unlet function in src/vim9cmds.c which allows a malicious attacker to read sensitive data in the system...

CVE-2021-32504

Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious attacker could use this sensitive information’s to launch further attacks on the system...

CVE-2021-32504

Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious attacker could use this sensitive information’s to launch further attacks on the system...

Information Disclosure

github.com/argoproj/argo-cd is vulnerable to information disclosure. The vulnerability exists because the YAML-formatted secrets are mounted as files on the repo-server which allows a malicious attacker to read the contents of the files...

Denial Of Service (DoS)

libjxl.so is vulnerable to denial of service. The vulnerability exist in the encxyb.cc due to lack of input validation which allows malicious attacker to crash the system...

Improper Access Control

octopoller is vulnerable to improper access control. The vulnerability exists because the files are given with world-writable permission without proper validations which allows a malicious attacker to modify files and change the existing behavior...