CVE-2022-39367 Vulnerability in handling of uploaded QTI ZIP files

QTIWorks is a software suite for standards-based assessment delivery. Prior to version 1.0-beta15, the QTIWorks Engine allows users to upload QTI content packages as ZIP files. The ZIP handling code does not sufficiently check the paths of files contained within ZIP files, so can insert files int...

PT-2022-26063 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions 00.00.01a and prior Description: The issue concerns the mishandling of .ZIP archives containing characters used in path traversal, which could result in remote code execution. This path...

Delta Electronics InfraSuite Device Master 路径遍历漏洞

Delta Electronics InfraSuite Device Master is used to simplify and automate the monitoring of critical equipment by Delta Electronics of Taiwan, China. A path traversal vulnerability exists in Delta Electronics InfraSuite Device Master 00.00.01a and prior versions, which stems from incorrectly...

PT-2022-24915 · Unknown · Gin-Vue-Admin

Name of the Vulnerable Software and Affected Versions: Gin-vue-admin versions prior to 2.5.4 Description: Gin-vue-admin is a backstage management system based on vue and gin. The system is vulnerable to path traversal, which leads to file upload vulnerabilities. This vulnerability allows maliciou...

Design/Logic Flaw

jadx is a set of command line and GUI tools for producing Java source code from Android Dex and Apk files. versions prior to 1.4.5 are subject to a Denial of Service when opening zip files with HTML sequences. This issue has been patched in version 1.4.5. There are no known workarounds...

Skylot Jadx 安全漏洞

Skylot Jadx is a Dex to Java decompiler. A security vulnerability exists in Skylot Jadx versions prior to 1.4.5, which stems from the fact that it can cause a denial of service when opening a zip file with an HTML sequence...

GHSA-3R7J-8MQH-6QHX Jadx-gui vulnerable to swing HTML Denial of Service (DoS) attack

Impact Using jadx-gui to open a special zip file with entry containing HTML sequence like will cause interface to get stuck and throw exceptions like: java.lang.RuntimeException: Can't build aframeset, BranchElementframeset 1,3 :no ROWS or COLS defined. at...

PT-2022-24851 · Jadx · Jadx

Name of the Vulnerable Software and Affected Versions: jadx versions prior to 1.4.5 Description: The issue concerns a Denial of Service that occurs when opening zip files containing HTML sequences. This can cause the interface to get stuck and throw exceptions. The problem arises when using...

Updated unzip packages fix security vulnerability

Improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution. CVE-2021-4217 Conversion of a wide string to a local string that leads to a heap of out-of-bound write. Thi...

Denial Of Service (DoS)

unzip is vulnerable to denial of service. The vulnerability exists because of the improper handling of Unicode strings, allowing an attacker to crash the application through the null pointer dereference by providing a maliciously crafted zip file...

Security Bulletin: Multiple vulnerabilities in Apache Ant affect IBM InfoSphere Information Server

Summary Multiple vulnerabilities in Apache Ant used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2021-36373 DESCRIPTION: Apache Ant is vulnerable to a denial of service, caused by an out-of-memory error when large amounts of memory are allocated. By...

USN-5673-1 unzip vulnerabilities

It was discovered that unzip did not properly handle unicode strings under certain circumstances. If a user were tricked into opening a specially crafted zip file, an attacker could possibly use this issue to cause unzip to crash, resulting in a denial of service, or possibly execute arbitrary...

CVE-2022-34430

Dell Hybrid Client below 1.8 version contains a Zip Bomb Vulnerability in UI. A guest privilege attacker could potentially exploit this vulnerability, leading to system files modification...

CVE-2022-34430

Dell Hybrid Client below 1.8 version contains a Zip Bomb Vulnerability in UI. A guest privilege attacker could potentially exploit this vulnerability, leading to system files modification...

Design/Logic Flaw

Dell Hybrid Client below 1.8 version contains a Zip Bomb Vulnerability in UI. A guest privilege attacker could potentially exploit this vulnerability, leading to system files modification...

CVE-2022-34430

Dell Hybrid Client below 1.8 version contains a Zip Bomb Vulnerability in UI. A guest privilege attacker could potentially exploit this vulnerability, leading to system files modification...

CVE-2022-34430

Dell Hybrid Client before version 1.8 contains a UI Zip Bomb vulnerability that could allow a guest-privileged attacker to modify system files. Affected product: Dell Hybrid Client; affected component: UI handling of compressed input. Root cause: Zip Bomb in UI processing (details per PT-2022-221...

CVE-2022-34430

Dell Hybrid Client below 1.8 version contains a Zip Bomb Vulnerability in UI. A guest privilege attacker could potentially exploit this vulnerability, leading to system files modification...

Dell Hybrid Client 安全漏洞

Dell Hybrid Client is a software application from Dell USA Inc. It provides a client computing software with hybrid cloud management capabilities. A security vulnerability previously existed in Dell Hybrid Client version 1.8, which stemmed from the inclusion of a Zip Bomb vulnerability in the UI....

PT-2022-22165 · Dell · Dell Hybrid Client

Name of the Vulnerable Software and Affected Versions: Dell Hybrid Client versions prior to 1.8 Description: The issue concerns a Zip Bomb Vulnerability in the UI of Dell Hybrid Client, which could be exploited by an attacker with guest privileges, potentially leading to modification of system...