GHSA-X698-5HJM-W2M5 pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages

Summary Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages. Details Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages. Thi...

CVE-2022-4009

In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation...

CVE-2019-14391

cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs SEC-514...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Overview UmbracoCms.Core is an ASP.NET CMS. Affected versions of this package are vulnerable to Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' due to insufficient validation of user-supplied input in the package creation functionality. An attacker with permission to...

Path traversal

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. Versions 8.18.10, 10.8.1, and 12.3.0...

CVE-2023-49089 Umbraco CMS possible path traversal when creating packages from backoffice

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. Versions 8.18.10, 10.8.1, and 12.3.0...

CVE-2023-42656

In Progress MOVEit Transfer versions released before 2021.1.8 13.1.8, 2022.0.8 14.0.8, 2022.1.9 14.1.9, 2023.0.6 15.0.6, a reflected cross-site scripting XSS vulnerability has been identified in MOVEit Transfer's web interface. An attacker could craft a malicious payload targeting MOVEit Transfer...

CVE-2023-32698

CVE-2023-32698 affects the nfpm tool (GoReleaser nfpm) where, if files are packaged without enforcing nfpm’s own permissions, checked‑in files could be created with dangerous permissions (e.g., 666 or 777). The root cause is incorrect/default file permission handling during packaging, leading to ...

CVE-2022-4009

In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation...

CVE-2022-4009

In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation...

CVE-2022-4009

In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation...

PT-2023-13750 · Unknown · Octopus Deploy

Name of the Vulnerable Software and Affected Versions: Octopus Deploy affected versions not specified Description: The issue allows a user to introduce code via offline package creation. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

CVE-2022-4009

In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation...

CVE-2020-25031

checkinstall 1.6.2, when used to create a package that contains a symlink, may trigger the creation of a mode 0777 executable file...

Code injection

checkinstall 1.6.2, when used to create a package that contains a symlink, may trigger the creation of a mode 0777 executable file...

CVE-2019-14391

cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs SEC-514...

Design/Logic Flaw

cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs SEC-514...

Packabit project: building Nmap deb packages for Ubuntu

During the long New Year holidays 30 dec - 8 jan I started a new project: Vagrant-based Linux package builder called Packabit. I thought it might be nice to have scripts that will automatically build a Linux packages from sources and will NOT litter main system with unnecessary packages. Somethin...

Design/Logic Flaw

The PackageManagerService class in services/java/com/android/server/PackageManagerService.java in Android 1.5 through 1.5 CRB42 does not properly check developer certificates during processing of sharedUserId requests at an application's installation time, which allows remote user-assisted...