Denial Of Service (DoS)

python is vulnerable to denial of service DoS. The vulnerability exists as Lib/zipfile.py allows ZIP bomb attacks which allows an attacker to cause an application crash...

CVE-2020-25790

Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. NOTE: the vendor disputes the significance of this report because "admins are considered trustworthy"; however, the behavior "contradicts our security policy" and is being...

Design/Logic Flaw

Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. NOTE: the vendor disputes the significance of this report because "admins are considered trustworthy"; however, the behavior "contradicts our security policy" and is being...

CVE-2020-25790

Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. NOTE: the vendor disputes the significance of this report because "admins are considered trustworthy"; however, the behavior "contradicts our security policy" and is being...

CVE-2020-25790

Summary: CVE-2020-25790 affects Typesetter CMS 5.x through 5.1. A ZIP upload feature allows an admin to place a PHP file inside the archive and, after extraction, execute the code, leading to arbitrary code execution. Root cause: uploaded ZIP contents can be executed via the web interface, confli...

PT-2020-16210 · Typesetter · Typesetter Cms

Name of the Vulnerable Software and Affected Versions: Typesetter CMS versions 5.x through 5.1 Description: The issue allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. This behavior contradicts the security policy, and the vendor is fixing it for version...

Security Bulletin: [All] Python (Publicly disclosed vulnerability)

Summary Vulnerabilities in Open Source Python affect IBM Tivoli Application Dependency Discovery Manager. Vulnerability Details CVEID: CVE-2019-9948 DESCRIPTION: Python could allow a remote attacker to bypass security restrictions, caused by improper input validation by the urllib. By sending a...

DEBIAN-CVE-2020-7068

In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, pharparsezipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure...

UBUNTU-CVE-2020-7068

In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, pharparsezipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure...

CVE-2018-13410 affecting package zip 3.0-5

CVE-2018-13410 affecting package zip 3.0-5. A patched version of the package is available...

[20210308] - Core - Path Traversal within joomla/archive zip class

Extracting an specifilcy crafted zip package could write files outside of the intended path...

Evilnum hackers targeting financial firms with a new Python-based RAT

An adversary known for targeting the fintech sector at least since 2018 has switched up its tactics to include a new Python-based remote access Trojan RAT that can steal passwords, documents, browser cookies, email credentials, and other sensitive information. In an analysis published by Cybereas...

CVE-2020-24948

The aoccssimport AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution...

CVE-2020-24948

The aoccssimport AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution...

@achingbrain/ngrok (0.2.2), @atomist/sdm-automation (>=0.1.16-master.20181116180810, <=0.1.59-master.20200611224542) +603 more potentially affected by unknown CVE via decompress-zip (>=0.0.2, <=0.2.0)

decompress-zip NPM version =0.0.2, =0.1.16-master.20181116180810, =14.0.5, =0.1.2, =1.2.6, =1.0.1, =1.0.0, =1.1.1, =5.0.1, =1.0.0, =5.2.1, =5.3.0 - @paulcbetts/squirrel-windows 1.2.1 - @pgswe/ics.js 0.1.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-73V8-V6G4-VRPM...

@angular/benchpress (0.1.0), @camptocamp/closure-util (>=1.20.0, <=1.27.0) +140 more potentially affected by unknown CVE via decompress-zip (>=0.3.0, <=0.3.1)

decompress-zip NPM version =0.3.0, =1.20.0, =0.4.0, =0.4.0, =0.5.0-beta.2, =1.36.0, =0.0.1, =3.6.0, =1.0.0, =0.1.0, =0.1.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-73V8-V6G4-VRPM...

GHSA-73V8-V6G4-VRPM Arbitrary File Overwrite in decompress-zip

Vulnerable versions of decompress-zip are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because decompress-zip does not verify that extracted files do not resolve to targets outside of the extraction root directory. Recommendation For...

Arbitrary File Overwrite in decompress-zip

Vulnerable versions of decompress-zip are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because decompress-zip does not verify that extracted files do not resolve to targets outside of the extraction root directory. Recommendation For...

GHSA-4QQC-MP5F-CCV4 Command Injection in bestzip

Versions of bestzip prior to 2.1.7 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the zip function . This may allow attackers to execute arbitrary code in the system as long as the values of destination is user-controlled...

Directory Traversal

github.com/u-root/u-root is vulnerable to directory traversal. A zip slip vulnerability allows an attacker to write arbitrary files on the system via a zip archive containing malicious file names with ../ characters...