Directory traversal

OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive...

CVE-2018-19859

OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive...

CVE-2018-19859

OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive...

CVE-2018-19859

OpenRefine before 3.2 beta is vulnerable to directory traversal via a relative pathname in a ZIP archive (CVE-2018-19859). The issue is confirmed across multiple advisories linking to OpenRefine's project import path handling. Mitigation known in the connected docs includes patches suggested by P...

CVE-2018-19859

OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive...

PT-2018-15130

Name of the Vulnerable Software and Affected Versions OpenRefine versions prior to 3.2 beta Description The issue allows directory traversal via a relative pathname in a ZIP archive. Recommendations For versions prior to 3.2 beta, update to version 3.2 beta or later to resolve the issue...

CVE-2018-19859: Improper Limitation of a Pathname to a Restricted Directory

OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive...

WS-2015-0070

In OpenRefine, versions 2.0 through 2.6-rc2 are vulnerable to Cross-Site Scripting, due to the ‘&' ampersand character not escaped when exporting cell values to HTML. An attacker could enter a crafted cell value to trigger arbitrary javascript code on a victim’s browser...