PT-2019-13474 · B3Log · B3Log Wide

Name of the Vulnerable Software and Affected Versions: b3log Wide versions prior to 1.6.0 Description: The issue allows an attacker to access arbitrary files through three types of attacks. First, an attacker can write and execute code in the editor to read arbitrary files. Second, an attacker ca...

CVE-2019-13453

Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32 and zipfile.cpp:Zipfile::Zipfile...

CVE-2019-13453

CVE-2019-13453 affects the zipios++ library prior to version 0.1.7, where it mishandles certain malformed ZIP archives and can enter an infinite loop, causing a denial of service. The root cause is tied to the code paths in zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile(). Documented i...

CVE-2019-13453

Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32 and zipfile.cpp:Zipfile::Zipfile...

SWEED: Exposing years of Agent Tesla campaigns

By Edmund Brumaghin and other Cisco Talos researchers. Executive summary Cisco Talos recently identified a large number of ongoing malware distribution campaigns linked to a threat actor we're calling "SWEED," including such notable malware as Formbook, Lokibot and Agent Tesla. Based on our...

Zipios Denial of Service Vulnerability

Zipios is a C++ library for reading and writing Zip files. A security vulnerability exists in Zipios that stems from the program's failure to properly handle malformed ZIP files. An attacker can exploit the vulnerability to cause a denial of service or consume system resources...

USN-4057-1 Zipios vulnerability

Mike Salvatore discovered that Zipios mishandled certain malformed ZIP files. An attacker could use this vulnerability to cause a denial of service or consume system resources. CVE-2019-13453...

USN-4055-1 flightcrew vulnerabilities

Mike Salvatore discovered that FlightCrew improperly handled certain malformed EPUB files. An attacker could potentially use this vulnerability to cause a denial of service. CVE-2019-13032 Mike Salvatore discovered that FlightCrew mishandled certain malformed EPUB files. An attacker could use thi...

JetBrains TeamCity suffers from an input validation error vulnerability

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. An input validation error vulnerability exists in...

Path Traversal

dotCMS is vulnerable to path traversal vulnerability. A remote, authenticated attacker could exploit the flaw due to insecure extraction of ZIP archives...

CVE-2019-13232

Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service resource consumption, aka a "better zip bomb" issue...

[SECURITY] [DLA 1846-1] unzip security update

Package : unzip Version : 6.0-16+deb8u4 CVE ID : CVE-2019-13232 Debian Bug : 931433 David Fifield discovered a way to construct non-recursive "zip bombs" that achieve a high compression ratio by overlapping files inside the zip container. However the output size increases quadratically in the inp...

Info-ZIP UnZip Denial of Service Vulnerability (CNVD-2019-21440)

Info-ZIP UnZip is the United States Greg Roelofs software developers of a set of Unix-based platform for the ".zip" file format for decompression tools. A security vulnerability exists in Info-ZIP UnZip version 6.0. An attacker could exploit this vulnerability to cause a denial of service...

CVE-2019-13241

FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ dot dot slash in a ZIP archive entry that is mishandled during extraction...

CVE-2019-13241

FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ dot dot slash in a ZIP archive entry that is mishandled during extraction...

Directory traversal

FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ dot dot slash in a ZIP archive entry that is mishandled during extraction...

CVE-2019-13241

FlightCrew v0.9.2 and older are affected by CVE-2019-13241 (directory traversal: can write arbitrary files via a ../ in a ZIP entry during extraction). Mageia advisories and Ubuntu USN entries also reference CVE-2019-13241 and confirm that updates fix these flaws; CVE-2019-13032 is a NULL pointer...

CVE-2019-13241

FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ dot dot slash in a ZIP archive entry that is mishandled during extraction...

AZL-6943 CVE-2019-13232 affecting package unzip for versions less than 6.0-19

Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service resource consumption, aka a "better zip bomb" issue...

CVE-2019-13232

Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service resource consumption, aka a "better zip bomb" issue...