GLSA-202005-01 : Long Range ZIP: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202005-01 Long Range ZIP: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Long Range ZIP. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to...

Long Range ZIP: Multiple vulnerabilities

Background Optimized for compressing large files Description Multiple vulnerabilities have been discovered in Long Range ZIP. Please review the CVE identifiers referenced below for details. Impact A remote attacker could entice a user to open a specially crafted archive file possibly resulting in...

Arbitrary File Read

Overview curlrequest is a curlrequest is a node wrapper for the command line curl1. Affected versions of this package are vulnerable to Arbitrary File Read. It is possible to read any file by populating the file parameter with user input. PoC var curl = require"curlrequest"; let userPayload =...

Elementor Pro < 2.9.4 - Authenticated Arbitrary File Upload

According to Jerome Bruandet, from NintechNet, the vulnerability, currently exploited by attackers, allows any logged-in user to upload and execute PHP scripts on the blog. Chloe Chamberland from Wordfence also confirmed the issue and added that "This vulnerability is being used in conjunction wi...

Arbitrary File Write

Overview actionpack-pagecaching is a static page caching library for Action Pack. Affected versions of this package are vulnerable to Arbitrary File Write. It is possible for an attacker to write unescaped ERB to a view, and therefore write arbitrary files to a web server, potentially resulting i...

CVE-2020-10859

Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted AppDependency API request...

CVE-2020-10859

Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted AppDependency API request...

Directory traversal

Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted AppDependency API request...

CVE-2020-10859

Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted AppDependency API request...

CVE-2020-10859

The CVE-2020-10859 entry applies to Zoho ManageEngine Desktop Central (before 10.0.484). The vulnerability is a Directory Traversal in the AppDependency API that, when an authenticated user issues a crafted ZIP extraction request, allows arbitrary file writes on the target system. This is trigger...

EulerOS Virtualization for ARM 64 3.0.2.0 : python (EulerOS-SA-2020-1516)

According to the versions of the python packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Python Software Foundation Python CPython version 2.7 contains a CWE-77: Improper Neutralization of Special Elements...

IBM WebSphere Application Server 7.x / 8.0.0.0 <= 8.0.0.15 / 8.5.0.0 <= 8.5.5.14 / 9.0.0.0 <= 9.0.0.9 Directory Traversal Vulnerability

A directory traversal vulnerability exists in WebSphere Application Server that is using Enterprise bundle Archives EBA. An authenticated, remote attacker can exploit this, by persuading a victim to extract a specially-crafted ZIP archive containing 'dot dot slash' ../ sequences, an attacker coul...

Huawei EulerOS: Security Advisory for python (EulerOS-SA-2020-1516)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-19102

A directory traversal vulnerability in SharpZipLib used in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x and 4.2.x allow unauthenticated users to write to certain local directories. The vulnerability is also known as zip slip...

Directory traversal

A directory traversal vulnerability in SharpZipLib used in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x and 4.2.x allow unauthenticated users to write to certain local directories. The vulnerability is also known as zip slip...

CVE-2019-19102 Zip Slip vulnerability in 3rd-Party library in B&R Automation Studio upgrade service

A directory traversal vulnerability in SharpZipLib used in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x and 4.2.x allow unauthenticated users to write to certain local directories. The vulnerability is also known as zip slip...

CVE-2019-19102

CVE-2019-19102 is a directory traversal (zip slip) vulnerability in SharpZipLib used by the upgrade service of B&R Automation Studio, affecting 4.0.x–4.2.x. It allows unauthenticated writers to create/overwrite files in local directories. CVSSv3.1 base score 7.5 (I:H) per NVD; base 5.5–5.0 in oth...

Moderate: Red Hat Security Advisory: zziplib security update

An update for zziplib is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Moderate: Red Hat Security Advisory: sqlite security and bug fix update

An update for sqlite is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

sqlite: zipfileUpdate in ext/misc/zipfile.c mishandles a NULL pathname during an update of a ZIP archive

zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive...