12512 matches found
UBUNTU-CVE-2021-23413
This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values e.g proto, toString, etc results in a returned object with a modified prototype instance...
Design/Logic Flaw
This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values e.g proto, toString, etc results in a returned object with a modified prototype instance...
CVE-2021-23413
This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values e.g proto, toString, etc results in a returned object with a modified prototype instance...
CVE-2021-23413
This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values e.g proto, toString, etc results in a returned object with a modified prototype instance...
CVE-2021-23413
CVE-2021-23413 affects jszip before 3.7.0. Crafting a ZIP with filenames equal to Object prototype properties (e.g., proto , toString) yields a returned object with a modified prototype. The connected IBM document confirms the CVE and description but provides no explicit remediation or patch vers...
MGASA-2021-0369 Updated golang packages fix security vulnerabilities
encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader for xml.NewTokenDecoder returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method CVE-2021-27918. net/http in Go before 1.15.12 and 1.16.x before 1.16....
jszip 安全漏洞
jszip is a JavaScript library for creating, reading and editing .zip files. A security vulnerability exists in jszip versions prior to 3.7.0, which stems from the fact that when a new zip file is created with the filename set to an object prototype value, an object with a modified instance of the...
NCH IVM Attendant 代码问题漏洞
NCH IVM Attendant is a complete voicemail, call attendant, and IVR solution for Windows.A security vulnerability exists in NCH IVM Attendant, which stems from the fact that if the pathname of a ZIP element is set to the Windows startup folder, a file with a built-in Out-Going Message function, or...
OESA-2021-1277 ant security update
Ant is a Java based build tool. In theory it is kind of like "make" without makes wrinkles and with the full portability of pure java code. Security Fixes: When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out...
CVE-2021-25808
A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a crafted ZIP file...
CVE-2021-25808
A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a crafted ZIP file...
Code injection
A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a crafted ZIP file...
CVE-2021-25808
A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a crafted ZIP file...
CVE-2021-25808
CVE-2021-25808 describes a code injection vulnerability in Bludit 3.13.1, where the file backup/plugin.php is susceptible to arbitrary code execution via a crafted ZIP file. The connected records confirm the affected component and the root cause (code injection in backup/plugin.php) but do not pr...
Bludit 代码注入漏洞
Bludit is an open source lightweight blog content management system CMS. backup/plugin.php in Bludit 3.13.1 is vulnerable to code injection, which could be exploited to execute arbitrary code via a crafted ZIP file...
The vulnerability of zip file compression software lies in the use of memory after it is freed, allowing an attacker to access confidential information or cause service failures.
The vulnerability of zip file compression software relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential information or cause service failures...
openSUSE: Security Advisory for sqlite3 (openSUSE-SU-2021:1058-1)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Photo Gallery < 1.5.79 - Stored XSS via Uploaded SVG in Zip
The plugin did not ensure that uploaded SVG files inside a Zipped archive added to a gallery do not contain malicious content. As a result, users allowed to add images to gallery can upload an SVG file containing JavaScript code, which will be executed when accessing the image directly ie in the...
Photo Gallery < 1.5.79 - Stored XSS via Uploaded SVG in Zip
The plugin did not ensure that uploaded SVG files inside a Zipped archive added to a gallery do not contain malicious content. As a result, users allowed to add images to gallery can upload an SVG file containing JavaScript code, which will be executed when accessing the image directly ie in the...
