GHSA-GRWX-4P5V-9G2G Plone is vulnerable to Information Exposure when generating zip archives

zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the cssgen contrib module. An attacker can read arbitrary files by manipulating the geshi-path or geshi-lang-path parameters. Details A Directory Traversal attack also known as path traversal aims to access files...

GHSA-W47P-5Q88-HJ5G Path Traversal in Apache Jetspeed

Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. dot dot in a ZIP archive entry, as demonstrated by...

GHSA-5CMG-8M8P-WHMJ GeniXCMS arbitrary PHP code execution

In the Upload Modules page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a module...

GeniXCMS arbitrary PHP code execution

In the Upload Modules page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a module...

GitHub Security Lab: [python]: Zip Slip Vulnerability

This bug was reported directly to GitHub Security Lab...

php:7.4 security update

libzip 1.6.1-1 - update to 1.6.1 - enable lzma support php-pear 1:1.10.12-1 - update PEAR to 1.10.12 - update ArchiveTar to 1.4.9 - update ConsoleGetopt to 1.4.3 - update XMLUtil to 1.4.5 php-pecl-apcu 5.1.18-1 - update to 5.1.18 php-pecl-rrd php-pecl-xdebug 2.9.5-1 - update to 2.9.5 php-pecl-zip...

openSUSE: Security Advisory for ant (SUSE-SU-2022:1418-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2021-25119

The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE...

CVE-2021-25119

The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE...

CVE-2021-25119

The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE...

CVE-2021-25119

CVE-2021-25119 affects the AGIL WordPress plugin up to version 1.0. The vulnerability stems from the plugin accepting all ZIP files and extracting them without validating the extracted file types, allowing an admin-level user to upload PHP or other arbitrary files and potentially achieve remote c...

WordPress plugin AGIL 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress AGIL plugin 1.0 and earlier versions have a file upload vulnerability, which stems from accepting a...

Arbitrary file write vulnerability in Jenkins Fortify CloudScan Plugin

A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers able to control rulepack zip file contents to overwrite any file on the Jenkins master file system, only limited by the permissions of the user the Jenkins...

GHSA-8864-PWHG-3MP2 Arbitrary file write vulnerability in Jenkins Fortify CloudScan Plugin

A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers able to control rulepack zip file contents to overwrite any file on the Jenkins master file system, only limited by the permissions of the user the Jenkins...

RDF4J vulnerable to zip slip

RDF4J prior to 2.5.0 allows Directory Traversal via ../ in an entry in a ZIP archive...

GHSA-X3CR-X949-H5JV RDF4J vulnerable to zip slip

RDF4J prior to 2.5.0 allows Directory Traversal via ../ in an entry in a ZIP archive...

GHSA-F6FV-FJG8-4M6W OpenRefine Directory Traversal

OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive...

OpenRefine Directory Traversal

OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive...

Improper Limitation of a Pathname to a Restricted Directory in WildFly

WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability...