WinRAR - Filename Spoofing (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/zip' class Metasploit3 'WinRAR Filename Spoofing', 'Description' = %q This module abuses a filename spoofing vulnerability in WinRAR. The...

WinRAR Filename Spoofing

This module abuses a filename spoofing vulnerability in WinRAR. The vulnerability exists when opening ZIP files. The file names showed in WinRAR when opening a ZIP file come from the central directory, but the file names used to extract and open contents come from the Local File Header. This...

WinRAR Filename Spoofing

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/zip' class Metasploit3 'WinRAR Filename Spoofing', 'Description' = %q This module abuses a filename spoofing vulnerability in WinRAR. The...

MGASA-2014-0140 Updated python3 package fixes security vulnerabilities

ZipExtFile.read goes into 100% CPU infinite loop on maliciously binary edited zips CVE-2013-7338...

APK unchecked name

APK signature verification does not check name lengths correctly, creating a difference between how the zip files are verified compared with how they are extracted which allows files in an existing APK to be replaced with new files. Exploited by RockMyMoto...

CVE-2013-4373

The storeFiles method in JPADriftServerBean in Red Hat JBoss Operations Network JON 3.1.2 allows local users to load arbitrary drift files into a server by writing the files to the temporary directory that is used to unpack zip files...

CVE-2013-4373

Red Hat JBoss Operations Network 3.1.2 is affected by CVE-2013-4373. The vulnerability is in JPADriftServerBean.storeFiles, which creates a predictable temporary directory when unpacking a zip file, allowing a local attacker to place their own drift files into the server. Impact is local, enablin...

CVE-2013-4373

The storeFiles method in JPADriftServerBean in Red Hat JBoss Operations Network JON 3.1.2 allows local users to load arbitrary drift files into a server by writing the files to the temporary directory that is used to unpack zip files...

[Patator v0.5] Multi-purpose brute-forcer, with a modular design and a flexible usage

Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage. Currently it supports the following modules: ftplogin : Brute-force FTP sshlogin : Brute-force SSH telnetlogin : Brute-force Telnet smtplogin : Brute-force SMTP smtpvrfy : Enumerate valid users using the SMTP VRF...

CVE-2013-0314

The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 does not properly check authentication when importing Zip files, which allows remote attackers to modify site contents, remove the site, or alter the access controls for portlets...

Design/Logic Flaw

The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 does not properly check authentication when importing Zip files, which allows remote attackers to modify site contents, remove the site, or alter the access controls for portlets...

CVE-2013-0314

The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 does not properly check authentication when importing Zip files, which allows remote attackers to modify site contents, remove the site, or alter the access controls for portlets...

[SECURITY] Fedora 17 Update: mc-4.8.6-2.fc17

Midnight Commander is a visual shell much like a file manager, only with many more features. It is a text mode application, but it also includes mouse support. Midnight Commander's best features are its ability to FTP, view tar and zip files, and to poke into RPMs for specific files...

Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x i386/x86_64 (20120221)

These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. It was discovered that Java2D did not properly check graphics rendering objects before passing them to the native renderer. Malicious input, or an untrusted Java application or applet could u...

Fedora Update for perl-PAR FEDORA-2011-16856

Check for the Version of perl-PAR OpenVAS Vulnerability Test Fedora Update for perl-PAR FEDORA-2011-16856 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Mandriva Linux Security Advisory : libzip (MDVSA-2012:034)

Multiple vulnerabilities has been found and corrected in libzip : libzip version = 0.10 uses an incorrect loop construct, which can result in a heap overflow on corrupted zip files CVE-2012-1162. libzip version = 0.10 has a numeric overflow condition, which, for example, results in improper...

Important: Red Hat Security Advisory: java-1.6.0-openjdk security update

Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

CentOS 6 : java-1.6.0-openjdk (CESA-2012:0135)

Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

java security update

CentOS Errata and Security Advisory CESA-2012:0135 Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring Syste...

Critical: java-1.6.0-openjdk

Issue Overview: It was discovered that Java2D did not properly check graphics rendering objects before passing them to the native renderer. Malicious input, or an untrusted Java application or applet could use this flaw to crash the Java Virtual Machine JVM, or bypass Java sandbox restrictions...