CVE-2019-12841

Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity. The issue was fixed in TeamCity 2018.2.2...

CVE-2019-12841

CVE-2019-12841 affects JetBrains TeamCity. The issue is an incorrect handling of user input during ZIP extraction in TeamCity, with the root cause being improper input handling during ZIP extraction. The vulnerability has been fixed in TeamCity 2018.2.2. Other connected sources corroborate this d...

CVE-2019-13082

Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lpupload.php unauthenticated file upload feature. It extracts a ZIP archive before checking its content, and once it has been extracted, does not check files in a recursive way. This means that by putting a .php file in a folder a...

Path traversal

dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create files. The vulnerability is caused by the insecure extraction of a ZIP archive...

plexus-archiver: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file

A path traversal vulnerability has been discovered in plexus-archiver when extracting a carefully crafted zip file which holds path traversal file names. A remote attacker could use this vulnerability to write files outside the target directory and overwrite existing files with malicious code or...

Arbitrary File Write

concourse-driver-java is vulnerable to arbitrary file write. The application does not properly validate the destination filepath when during zip file extraction, allowing a malicious user to control the write destination and overwrite files...

Jenkins Server-Side Request Forgery Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is a Java-based continuous integration tool from CloudBees, Inc. It is mainly used to monitor continuous software releases/testing projects and a number of timed tasks.LTS Long-Term Support is a long-supported version of CloudBees Jenkins a long-ter...

UBUNTU-CVE-2017-1000472

The ZipCommon::isValidPath function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does not properly restrict the filename value in the ZIP header, which allows attackers to conduct absolute path traversal attacks during the ZIP decompression, and possibly create or overwrite arbitrary...

Kodi Directory Traversal Vulnerability

Kodi is an open source media player developed by the XBMC Foundation that supports playback of most videos, music, podcasts, and a variety of common digital media files from local or networked storage devices. A directory traversal vulnerability exists in the 'Zip Extraction built-in' function in...

CVE-2017-8314

Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles...

CVE-2017-8314

Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles...

UBUNTU-CVE-2017-8314

Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles...

CVE-2017-8314

Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles...

DEBIAN-CVE-2017-8314

Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles...

CVE-2017-8314

Kodi 17.1 and earlier are affected by a Directory Traversal in the Zip Extraction built-in function, allowing arbitrary file writes when processing a ZIP subtitle file. The exploitation path involves a specially crafted subtitle ZIP, which can write files to disk with the privileges of the Kodi p...

CVE-2017-8314

Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles...

UBUNTU-CVE-2016-6289

Integer overflow in the virtualfileex function in TSRM/tsrmvirtualcwd.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service stack-based buffer overflow or possibly have unspecified other impact via a crafted extract operation on a Z...

JDownloader 2 Beta Directory Traversal Vulnerability

Exploit for multiple platform in category web applications =begin Exploit Title: JDownloader 2 Beta Directory Traversal Vulnerability Zip Extraction Date: 2015-06-02 Exploit Author: PizzaHatHacker Vendor Homepage: http://jdownloader.org/home/index Software Link:...

JDownloader 2 Beta - Directory Traversal

=begin Exploit Title: JDownloader 2 Beta Directory Traversal Vulnerability Zip Extraction Date: 2015-06-02 Exploit Author: PizzaHatHacker Vendor Homepage: http://jdownloader.org/home/index Software Link: http://jdownloader.org/download/offline Version: 1171 = SVN Revision = 2331 Contact:...

TurboMail邮箱系统越权读取任意文件、导入备份等（可读取任意用户及管理员密码等）

简要描述： TurboMail邮箱系统越权读取任意文件（可读取管理员密码等） 详细说明： http://localhost/tmw/8/viewfile/account.xml?type=gl&logtype=../../turbomail/accounts/root/postmaster（你想要读密码的用户名）&sessionid=此处需普通用户sessionid 可以读取任意用户密码 此处导入的是zip文件，会自动解压，你也可以导入你上传的其他文件，如图片后缀的zip也可以解压...