Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the component /index.php?page=backup/export. An attacker can access files and directories stored outside of the web server's root directory by manipulating file paths in the input. PoC php Details A Directory...

Security Bulletin: IBM Storage Protect Server is susceptible to vulnerability in Golang Go (CVE-2024-24789).

Summary Golang Go is used by the IBM Storage Protect Server OSSM component. Golang Go is vulnerable to loss of confidentiality and integrity of host system. This bulletin identifies the steps to address the vulnerability. Vulnerability Details CVEID:CVE-2024-24789 DESCRIPTION: Golang Go could all...

CVE-2020-36842

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvividuploadimportfiles and wpvividuploadfiles AJAX actions that allows low-level authenticated attackers to upload zip files that can be subsequently...

CVE-2020-36842

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvividuploadimportfiles and wpvividuploadfiles AJAX actions that allows low-level authenticated attackers to upload zip files that can be subsequently...

CVE-2020-36842

CVE-2020-36842 — WPvivid WordPress plugin : The Migration, Backup, Staging WPvivid plugin is vulnerable to arbitrary file uploads due to a missing capability check on the wpvivid_upload_import_files and wpvivid_upload_files AJAX actions. This allows low‑level authenticated attackers to upload zip...

Astaroth Banking Malware Resurfaces in Brazil via Spear-Phishing Attack

A new spear-phishing campaign targeting Brazil has been found delivering a banking malware called Astaroth aka Guildma by making use of obfuscated JavaScript to slip past security guardrails. "The spear-phishing campaign's impact has targeted various industries, with manufacturing companies, reta...

server crash by zip bomb

This report is not public...

[SECURITY] Fedora 41 Update: libgsf-1.14.53-1.fc41

A library for reading and writing structured files e.g. MS OLE and Zip...

USN-7015-4: Python vulnerability

USN-7015-1 fixed several vulnerabilities in Python. This update provides the corresponding update for CVE-2023-27043 for python2.7 and python3.5 in Ubuntu 14.04 LTS. Original advisory details: It was discovered that the Python email module incorrectly parsed email addresses that contain special...

[SECURITY] Fedora 40 Update: libgsf-1.14.53-1.fc40

A library for reading and writing structured files e.g. MS OLE and Zip...

[SECURITY] Fedora 39 Update: libgsf-1.14.53-1.fc39

A library for reading and writing structured files e.g. MS OLE and Zip...

Debian dla-3915 : fonts-opensymbol - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3915 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3915-1 [email protected] https://www.debian.org/lts/security/...

CVE-2024-9232 Download Plugins and Themes in ZIP from Dashboard <= 1.9.1 - Reflected Cross-Site Scripting

The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.9.1. This makes it possible for unauthenticated attackers to...

Extract 安全漏洞

Extract is a Go library open-sourced by codeclysm. It is used to extract archives in zip, tar.gz or tar.bz2 format. A security vulnerability exists in Extract versions prior to 4.0.0, which stems from a maliciously constructed archive file that allows an attacker to create symbolic links outside ...

WordPress plugin Download Plugins and Themes in ZIP from Dashboard 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

Directory Traversal

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Directory Traversal within the isinorequal function. An attacker can access restricted files by manipulating file paths using parent directory...

[SECURITY] Fedora 41 Update: p7zip-16.02-31.fc41

p7zip is a port of 7za.exe for Unix. 7-Zip is a file archiver with a very high compression ratio. The original version can be found at http://www.7-zip.org/...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2024-2504)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP12 : golang (EulerOS-SA-2024-2504)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment...

EulerOS 2.0 SP11 : python-zipp (EulerOS-SA-2024-2567)

According to the versions of the python-zipp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A Denial of Service DoS vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggere...