CVE-2024-54682 Zipbomb DoS via Missing Slack Import Validation

Mattermost versions 10.1.x = 10.1.2, 10.0.x = 10.0.2, 9.11.x = 9.11.4, 9.5.x = 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin...

CVE-2024-54682 Zipbomb DoS via Missing Slack Import Validation

Mattermost versions 10.1.x = 10.1.2, 10.0.x = 10.0.2, 9.11.x = 9.11.4, 9.5.x = 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a denial of service vulnerability that stems from a failure to limit the file size of slack import file uploads. An attacker could exploit this vulnerability to import data to...

PT-2024-40644 · Oracle · Java

Name of the Vulnerable Software and Affected Versions: Java versions affected versions not specified Description: The issue is related to a security exception in the Java java.util.zip package. Specifically, the crash occurs in the jflex.core.NFA.insertNFA and...

BIT-PYTHON-2024-0450 Quoted zip-bomb protection for zipfile

An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython...

Directory Traversal

Overview spatie/browsershot is a library for converting a webpage to an image or pdf using headless Chrome. Affected versions of this package are vulnerable to Directory Traversal due to URI normalisation in the browser where the file:// check can be bypassed with file:\. An attacker could read...

CVE-2024-55587

python-libarchive through 4.2.1 allows directory traversal to create files in extract in zip.py for ZipFile.extractall and ZipFile.extract...

Oracle Linux 8 : php:8.2 (ELSA-2024-10951)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-10951 advisory. libzip php 8.2.25-1 - rebase to 8.2.25 RHEL-66166 php-pear php-pecl-apcu php-pecl-rrd php-pecl-xdebug3 php-pecl-zip Tenable has extracted the precedin...

The vulnerability of the Archive Extraction Handler component in the Luigi library for the Python programming language allows a hacker to execute arbitrary code.

The vulnerability of the Archive Extraction Handler component in the Luigi library for the Python programming language is related to an incorrect limitation on the path name of the restricted access directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using ...

python-libarchive 安全漏洞

python-libarchive is a Libarchive wrapper for Python open-sourced by SmartFile. A security vulnerability exists in python-libarchive version 4.2.1, which stems from allowing directory traversal of ZipFile.extractall and ZipFile.extract in a zip.py extraction...

Directory Traversal

Overview python-libarchive is an A libarchive wrapper for Python supporting password protection. Affected versions of this package are vulnerable to Directory Traversal due to improper input sanitization through the ZipFile, extract and extractall methods. An attacker can create arbitrary files o...

Modular Java Backdoor Dropped in Cleo Exploitation Campaign

Many thanks to Rapid7 MDR and incident response teams for their contributions to this analysis. While investigating incidents related to Cleo software exploitation, Rapid7 Labs and MDR observed a novel, multi-stage attack that deploys an encoded Java Archive JAR payload. Our investigation reveale...

CVE-2024-55587

The CVE-2024-55587 issue affects python-libarchive up to version 4.2.1, as reported by Red Hat/NVD and corroborating sources. The vulnerability exists in ZipFile.extractall and ZipFile.extract (in zip.py), enabling directory traversal to create files outside the intended directory. The Red Hat en...

PT-2024-36562

Name of the Vulnerable Software and Affected Versions python-libarchive versions 4.2.1 and earlier Description The issue allows directory traversal, enabling the creation of files in extract in zip.py for ZipFile.extractall and ZipFile.extract functions. This can be exploited to create files...

Amazon Linux 2022 : golang, golang-bin, golang-misc (ALAS2022-2021-007)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2021-007 advisory. A validation flaw was found in golang. When invoking functions from WASM modules built using GOARCH=wasm GOOS=js, passing very large arguments can cause portions of the module to be overwritten...

Exploit for CVE-2024-55587

CVE-2024-55587 This repository is proof of concept for C...

GHSA-8QCH-VJ6M-2694 luigi Arbitrary File Write via Archive Extraction (Zip Slip)

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper destination file path validation in the extractpackagesarchive function...

luigi Arbitrary File Write via Archive Extraction (Zip Slip)

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper destination file path validation in the extractpackagesarchive function...

PYSEC-2024-159

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper destination file path validation in the extractpackagesarchive function...

CVE-2024-21542

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper destination file path validation in the extractpackagesarchive function...