CVE-2023-5938 Path traversal via 'zip slip' in Arc before v1.6.0

Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal via 'zip slip' attacks. An administrator able to provide tampered archives to be processed by the affected versions of Arc may be able to have arbitrary files...

CVE-2023-5938

CVE-2023-5938 affects Arc up to versions prior to 1.6.0. The vulnerability arises because multiple functions process archives without validating contained filenames, enabling path traversal via zip slip. An administrator able to supply tampered archives to Arc could cause arbitrary files to be ex...

PT-2024-14847 · Arc · Arc

Name of the Vulnerable Software and Affected Versions: Arc affected versions not specified Description: The issue arises from multiple functions using archives without properly validating the filenames, making the application susceptible to path traversal via 'zip slip' attacks. An administrator...

Path traversal via 'zip slip' in Arc before v1.6.0

Summary Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal via 'zip slip' attacks. Impact An administrator able to provide tampered archives to be processed by the affected versions of Arc may be able to have...

CVE-2024-32465 Git's protections for cloning untrusted repositories can be bypassed

Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with git clone --no-local to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but...

Advisory ROSA-SA-2024-2421

Software: libarchive 3.3.3 OS: ROSA Virtualization 2.1 packageevrstring: libarchive-3.3.3 CVE-ID: CVE-2019-11463 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A memory leak in archivereadformatzipcleanup in archivereadsupportformatzip.c in libarchive 3.3.4-dev allows remote attackers to cause a denial...

Insert or Embed Articulate Content into WordPress <= 4.3000000023 - Author+ Upload to RCE

Description The plugin is not properly filtering which file extensions are allowed to be imported on the server, allowing the uploading of malicious code within zip files PoC Note: This must be tested on a web server running Apache 1 Create a new post 2 Add e-Learning block to the post and upload...

RHEL 7 : ant (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - ant: insecure temporary file CVE-2020-11979 - When reading a specially crafted TAR archive an Apache Ant...

RHEL 7 : zziplib (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - zziplib: uncontrolled memory allocation in zzipparserootdirectory in zzip/zip.c CVE-2018-6869 - Heap-base...

RHEL 8 : python (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - python: Nested zip file Zip bomb vulnerability in Lib/zipfile.py CVE-2019-9674 - Modules/pickle.c in Pyth...

RHEL 7 : testng (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - testng: a path traversal in zip files CVE-2022-4065 Note that Nessus has not tested for this issue but has instead...

RHEL 6 : nautilus (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - nautilus: Insufficient validation of trust of .desktop files with execute permission CVE-2017-14604 - GNO...

RHEL 5 : unzip (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - unzip: Heap-based buffer overflow in fileio.c:UzpPassword function allows code execution CVE-2018-1000035...

SUSE SLED15: libpython3_11-1_0 / libpython3_11-1_0-32bit / python311 / etc (SUSE-SU-2024:1556-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1556-1 advisory. - CVE-2024-0450: Fixed 'quoted-overlap' issue inside the zipfile module bsc1221854. -...

VulnCheck KEV: CVE-2015-2331

Integer overflow in the zipcdirnew function in zipdirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service application crash or possibly...

The vulnerability of the PowerPanel Business monitoring and power source management system, related to errors in processing the relative path to the catalog, allows a perpetrator to execute arbitrary code.

The vulnerability of the PowerPanel Business monitoring and power source management system is related to errors in processing the relative path to the catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created zip file...

CVE-2023-51599

Honeywell Saia PG5 Controls Suite Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the...

CVE-2023-51599

Honeywell Saia PG5 Controls Suite Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the...

CVE-2023-51599

Honeywell Saia PG5 Controls Suite Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the...

CVE-2023-40481

7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page o...