CVE-2020-7664

In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

Code injection

In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

Code injection

In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

CVE-2020-7668

In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

UBUNTU-CVE-2020-7668

In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

UBUNTU-CVE-2020-7664

In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

Zip Cracker - Python Script To Crack Zip Password With Dictionary Attack And Also Use Crunch As Pipeline

This Script Supports Only Zip File in This Version You Can Also Use This Script With crunch Cross-platform Supported Usage: zipcracker.py options Options: --version show program's version number and exit -h, --help show this help message and exit -f FILENAME, --file=FILENAME Please Specify Path o...

Directory Traversal

Overview rollup-plugin-serve-favicon is a rollup plugin to serve bundles. Affected versions of this package are vulnerable to Directory Traversal. There is no path sanitization in readFile operation. PoC by JHU System Security Lab Step 1: start a server var server = require"rollup-plugin-serve";...

Directory Traversal

Overview rollup-plugin-dev-server is a server for serving rolled up bundles like webpack-dev-server. Affected versions of this package are vulnerable to Directory Traversal. There is no path sanitization in readFile operation inside the readFileFromContentBase function. PoC by JHU System Security...

Directory Traversal

Overview rollup-plugin-server is a rollup plugin to serve the bundle. Affected versions of this package are vulnerable to Directory Traversal. There is no path sanitization in readFile operation performed inside the readFileFromContentBase function. PoC by JHU System Security Lab 1. Create a serv...

Directory Traversal

Overview marscode is a web editor created with monaco-editor, jquery file tree and nodejs file tree to read, write, edit, delete CRUD files. Affected versions of this package are vulnerable to Directory Traversal. There is no path sanitization in the path provided at fs.readFile in index.js. PoC ...

Directory Traversal

github.com/helm/helm is vulnerable to directory traversal. A zip-slip vulnerability when installing Helm plugins from a tar archive over HTTP allows an attacker to overwrite arbitrary files which could potentially result in arbitrary code execution when system files are overwritten...

CVE-2020-7664

The CVE-2020-7664 issue affects the Go package github.com/unknwon/cae/zip, specifically the ExtractTo function. The vulnerability arises because ExtractTo does not securely escape file paths in zip archives that contain leading or non-leading “..”, enabling path traversal that could allow an atta...

CVE-2020-7664 Arbitrary File Write via Archive Extraction (Zip Slip)

In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

The vulnerability of the ManageEngine Desktop Central software for managing workstations via a web interface lies in the lack of restrictions on the download of files of unsanctioned types. This allows a malicious individual to download a specially created malicious ZIP file.

The vulnerability of the ManageEngine Desktop Central software for managing workstations via a web interface is related to the lack of restrictions on the download of files of non-safe types. Exploiting this vulnerability allows a malicious actor to download a specially created malicious ZIP file...

EulerOS 2.0 SP2 : unzip (EulerOS-SA-2020-1671)

According to the version of the unzip package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service resource consumption, aka a 'better zip...

EulerOS 2.0 SP2 : python (EulerOS-SA-2020-1646)

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct...

CVE-2020-7495

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability during zip file extraction exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XD which could cause unauthorized write access outside of expected pa...

CVE-2020-7495

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability during zip file extraction exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XD which could cause unauthorized write access outside of expected pa...

Path traversal

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability during zip file extraction exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XD which could cause unauthorized write access outside of expected pa...