Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Python vulnerabilities (USN-4428-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4428-1 advisory. It was discovered that Python documentation had a misleading information. A security issue could be possibly caused by wrong...

USN-4428-1: Python vulnerabilities

It was discovered that Python documentation had a misleading information. A security issue could be possibly caused by wrong assumptions of this information. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM, Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. CVE-2019-17514 It was discovered that...

SAP NetWeaver AS Java Multiple Vulnerabilities

The version of SAP NetWeaver AS Java detected on the remote host may be affected by multiple vulnerabilities, as referenced in SAP Security Note 2934135. - LM Configuration Wizard of SAP NetWeaver AS JAVA, does not perform an authentication check which allows an attacker without prior...

Path traversal

The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA LM Configuration Wizard, versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to exploit a method to download zip files to a specific directory, leading to Path Traversal...

Threat Spotlight: Valak Slithers Its Way Into Manufacturing and Transportation Networks

By Nick Biasini, Edmund Brumaghin and Mariano Graziano. Threat summary Attackers are actively distributing the Valak malware family around the globe, with enterprises, in particular, being targeted.These campaigns make use of existing email threads from compromised accounts to greatly increase...

(Pwn2Own) Schneider Electric EcoStructure Operator Terminal Expert ZIP Path Traversal Remote Code Execution Vulnerability

The vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStructure Operator Terminal Expert. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specif...

Moderate: Red Hat Security Advisory: zziplib security update

An update for zziplib is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Moderate: zziplib security update

The zziplib is a lightweight library to easily extract data from zip files. Security Fixes: zziplib: directory traversal in unzzipcat in the bins/unzzipcat-mem.c CVE-2018-17828 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...

CVE-2020-10267

Universal Robots control box CB 3.1 across firmware versions tested on 1.12.1, 1.12, 1.11 and 1.10 does not encrypt or protect in any way the intellectual property artifacts installed from the UR+ platform of hardware and software components URCaps. These files .urcaps are stored under...

Atlassian Jira 8.2 < 8.5.4 Support Files Improper Authorization Vulnerability (JRASERVER-70564)

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is version 8.2.x prior to 8.5.4. It is, therefore, affected by an improper authorization vulnerability. Support zip files could be downloaded by a system administrator user without...

Unspecified Vulnerability in Avira Antivirus Pro, Antivirus Pro Plus and Antivirus for Linux

Avira Antivirus Pro 2019 is a famous antivirus software for computers.Avira Antivirus Pro Plus is an ultimate security product more suitable for business security protection to help users against viruses. There is a security vulnerability in Avast AV parsing engine. The vulnerability can be...

The vulnerability of the `__zzip_fetch_disk_trailer` function in the ZZIPlib compression library, which stems from insufficient validation of input data, allows attackers to trigger a service failure.

The vulnerability of the zzipfetchdisktrailer function in the ZZIPlib compression library is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures by using a specially created zip file...

Cisco Email Security Appliance Content Filter Bypass Vulnerability (CSCvq65126)

According to its self-reported version, Cisco Email Security Appliance ESA is affected by an input-validation flaw related to the email message filtering feature and zip files that allows denial of service attacks. Please see the included Cisco BID and Cisco Security Advisory for more information...

CVE-2019-20402

Affected product: Atlassian Jira Server and Data Center. Vulnerability: improper authorization allows a System Administrator to download Support zip files without re-entering a password. Affected versions: Jira Server/Data Center before 8.6.0. Impact: potential unauthorized access to support file...

CVE-2019-20402

Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their password via an improper authorization vulnerability...

AZL-6933 CVE-2014-8139 affecting package unzip for versions less than 6.0-19

Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command...

Input validation

A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper validation of zip files. An...

CVE-2020-3134 Cisco Email Security Appliance Zip Decompression Engine Denial of Service Vulnerability

A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper validation of zip files. An...

Remote code execution

An issue was discovered in ConnectWise Control formerly known as ScreenConnect 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server...

Fedora Update for rubygem-rubyzip FEDORA-2019-8ecd991303

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...