Input validation

Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

CVE-2020-36566 Path traversal in github.com/whyrusleeping/tar-utils

Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

tar-utils 路径遍历漏洞

tar-utils is a set of tar utilities from the go-ipfs codebase by the individual developer Whyrusleeping. A path traversal vulnerability exists in tar-utils, which stems from an incorrect path, where an archive file containing a relative file path could result in a file being written or overwritte...

go-unzip 路径遍历漏洞

Package go-unzip is a very simple library from the personal developer Dariusz Prząda. It is used to extract zip archives. A path traversal vulnerability exists in go-unzip, which stems from an incorrect path, where an archive containing relative file paths may cause files to be written or...

The vulnerabilities of Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IoT, Snapdragon Industrial IoT, Snapdragon Mobile, Snapdragon Voice & Music, and Snapdragon Wearables software in embedded chips from Qualcomm arise from operations that occur outside of the buffer in memory. This allows attackers to disclose sensitive information or cause system failures.

The vulnerabilities of Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IoT, Snapdragon Industrial IoT, Snapdragon Mobile, Snapdragon Voice & Music, and Snapdragon Wearables software are due to operations occurring outside of the buffer in memory. Exploiting these...

DEBIAN-CVE-2022-28286

Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks. This vulnerability affects Thunderbird 91.8, Firefox 99, and Firefox ESR 91.8...

Path Traversal

ubi-reader is vulnerable to path traversal. The vulnerability exists in the extractdents function in output.py, allowing an attacker to overwrite files outside of the extraction directory through the URL path such as ../../tmp/outside.txt...

MAL-2022-1123 Malicious code in arpanrizki-panpan (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6b640fbdbb106e7e039396ba5e56295d4388dcf0b3a2865daaaf226affc4253 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6488 Malicious code in test-pls (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e944bd9669b6670b936f57b7f11202f8a8c0bdf172864bc6e95f9ff567a97ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Mozilla: Iframe contents could be rendered outside the iframe

The Mozilla Foundation Security Advisory describes this flaw as: Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks...

kernel: KVM: cmpxchg_gpte can write to pfns outside the userspace region

A flaw was found in KVM. When updating a guest's page table entry, vmpgoff was improperly used as the offset to get the page's pfn. As vaddr and vmpgoff are controllable by user-mode processes, this flaw allows unprivileged local users on the host to write outside the userspace region and...

Mozilla: Iframe contents could be rendered outside the iframe

The Mozilla Foundation Security Advisory describes this flaw as: Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks...

MAL-2022-6038 Malicious code in setup-gamma (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware deba7e063fe3b4609326e55cea28db816c7049297f8cef8b23d8c2d7589f69f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in teleterm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 42f34af57c7c8ae4664015ace23dd33fc3e1f96af2443c9f5a37f7a829657d52 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5450 Malicious code in preply-riddle-online-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6488e7d6017789ffad8b23dd037223fc87627c59ae8854b6b2517397e22e275c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2 Malicious code in --hiljson (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 346600b3c428f935cffe333f73dbf2bd10ff54fce19d9349db9de380ddc45de8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in securityrele (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 185b542d66b1e73e39974ac16964546da7a68898526013750a29430a2454aab7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5533 Malicious code in pv_ho3ein (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7aa33fb89a5d7bd38f7efcced8a18b26c18b81d9e112bfd15547d569cee8f2f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in arpan-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94611fae33d6748195d928999375279918e9af944e726bf73a25f75a3ae15d5e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3751 Malicious code in icon-ionicons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3ea0dd0a77658f88ec68d9fe8b13765b6debe58e5a5bb0aa726f11c8d08d42e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...