CVE-2018-16370

In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a ZIP archive...

CVE-2018-16370

In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a ZIP archive...

CVE-2018-16370

In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a ZIP archive...

CVE-2018-16320

idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file...

Directory traversal

idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file...

CVE-2018-16320

idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file...

CVE-2018-16320

CVE-2018-16320 affects idreamsoft iCMS 7.0.11. A directory traversal flaw in admincp.php?app=config enables arbitrary PHP code execution from a ZIP file. Root cause: path traversal in the configuration admin endpoint. Impact: arbitrary code execution; exploitation status is not provided in the do...

CVE-2018-16320

idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file...

CVE-2018-16302

MediaComm Zip-n-Go before 4.95 has a Buffer Overflow via a crafted file...

Buffer overflow

MediaComm Zip-n-Go before 4.95 has a Buffer Overflow via a crafted file...

CVE-2018-16302

MediaComm Zip-n-Go before 4.95 has a Buffer Overflow via a crafted file...

CVE-2018-16302

CVE-2018-16302 affects MediaComm Zip-n-Go versions before 4.95, where a crafted file can trigger a buffer overflow. Documented impact indicates potential denial of service or arbitrary code execution with high impact to confidentiality, integrity, and availability (CVSS: 7.8–9.3). The issue is pu...

CVE-2018-16302

MediaComm Zip-n-Go before 4.95 has a Buffer Overflow via a crafted file...

Updated quazip packages fix security vulnerability

Updated quazip packages fix security vulnerability: A vulnerability has been found in the way developers have implemented the archive extraction of files. An arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar,x...

Denial Of Service (DoS) Via Zip Bomb

akka-http is vulnerable to denial of service via a Zip Bomb. The vulnerability is caused by the application not having size limitations on decompressed data from the directives decodeRequest and decodeRequestWith or when using them in combination with directives like entityas, toStrict, or...

Akka HTTP 10.0.x, 10.1.x Denial of Service vulnerability

Akka HTTP is prone to a Denial of Service vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Samsung Notes Path Traversal Vulnerability

Samsung Notes is a Notes series of smartphone products from Samsung South Korea. A path traversal vulnerability exists in the handling of ZIP files in Samsung Notes, which stems from the program failing to properly validate a user-submitted path before using it when performing file operations. A...

CVE-2018-16131

The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service memory consumption and daemon crash via a ZIP bomb...

Design/Logic Flaw

The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service memory consumption and daemon crash via a ZIP bomb...

CVE-2018-16131

The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service memory consumption and daemon crash via a ZIP bomb...