PT-2023-19504 · Unknown · Textpattern

Name of the Vulnerable Software and Affected Versions: Textpattern version 4.8.8 Description: An arbitrary file upload vulnerability in the plugin upload function allows attackers to execute arbitrary code via a crafted Zip file. Recommendations: For Textpattern version 4.8.8, at the moment, ther...

7-Zip 安全漏洞

7-Zip is a compression software from the 7-Zip open source. A security vulnerability exists in 7-Zip version 22.01 that stems from an error that does not report certain invalid xz files...

What will be the consequence of this disputed vulnerability in 7-ZIP?

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here The zero-day vulnerability in 7- Zip software, tracked as CVE-2022-29072 is marked as disputed by the National Vulnerability DatabaseNVD, and sparked discussions over its consequences. This started when a researcher published ...

7-Zip 缓冲区错误漏洞

7-Zip is a compression software. A buffer error vulnerability exists in 7-Zip 21.07 that allows privilege escalation and command execution when a file with the extension .7z is dragged into the HelpContents area. This is caused by a 7z.dll configuration error and heap overflow. The command runs i...

PT-2022-2258

Name of the Vulnerable Software and Affected Versions 7-Zip versions 21.07 and earlier Description The issue is related to a heap overflow in the 7z.dll library, which can be exploited to escalate privileges. This can be achieved by dragging a specially crafted .7z file to the HelpContents area,...

W-Zip 路径遍历漏洞

W-Zip is a Zip and 7Z compression utility. A path traversal vulnerability exists in w-zip that stems from path traversal in NPM w-zip before 1.0.12...

Denial Of Service (DoS)

rustc:sid is vulnerable to denial of service. The Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer overflow when a consumed Zip iterator is used again...

golang: archive/zip: malformed archive may cause panic or memory exhaustion

A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic or potentially exhaust system memory when parsing malformed ZIP files...

PT-2021-16921 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.9.24 Description: An issue was discovered where extracting a specifically crafted zip package could write files outside of the intended path. Recommendations: For Joomla! versions 3.0.0 through 3.9.24, update ...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview github.com/unknwon/cae/zip is a package that provides archiving functionality for .zip archives. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. The ExtractTo function doesn't securely escape file paths in zip archives which inclu...

Path Traversal

dotCMS is vulnerable to path traversal vulnerability. A remote, authenticated attacker could exploit the flaw due to insecure extraction of ZIP archives...

Updated busybox packages fix security vulnerability

Unziping a specially crafted zip file results in a computation of an invalid pointer and a crash reading an invalid address CVE-2015-9261...

Arbitrary File Overwrite

booster-catalog-service is vulnerable to arbitrary file overwrite attacks. The vulnerability exists due to the improper sanitization of filename when unzipping files in a zip, causing arbitrary file overwrite attacks...

Open Networking Foundation ONOS Path Traversal Vulnerability

Open Networking Foundation ONF ONOS is an open source SDN network operating system. A directory traversal vulnerability exists in the core/common/src/main/java/org/onosproject/common/app/ApplicationArchive.java file in ONF ONOS 1.13.2 and earlier versions. The vulnerability can be exploited to...

The vulnerability of the extractDir function in the Zip4j library, which allows a hacker to execute arbitrary code.

The vulnerability of the extractDir function in the Zip4j library, which is used for working with zip files, is related to an incorrect limitation on the path name of the directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code using a...

Advancecomp Buffer Overflow Vulnerability

advancecomp is a collection of recompression utilities for files in zip, png, mng and gz formats. A buffer overflow vulnerability exists in the 'zip.cc:zipentry::loadcent' function in versions prior to advancecomp 2.1-2018/02. An attacker can exploit the vulnerability to cause a denial of service...

CVE-2018-1002201

zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ dot dot slash in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'...

UBUNTU-CVE-2018-13410

Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service invalid free and application crash or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an...

Arbitrary File Write

adm-zip is vulnerable to arbitrary file write. The application does not properly validate the destination filepath during compressed file extraction, allowing a malicious user to overwrite files in the target directory...

7zip < 18.03 Authentication Bypass Vulnerability - Windows

7zip is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...