amazon link project amazon link vulnerabilities and exploits

(subscribe to this query)

The Amazon Link WordPress plugin up to and including 3.2.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.

Amazon Link Project Amazon Link

(1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow remote malicious users to cause a denial of service (application crash) via a crafted input.

Squashfs Project Squashfs

keycloak-httpd-client-install versions prior to 0.8 insecurely creates temporary file allowing local malicious users to overwrite other files via symbolic link.

Keycloak-httpd-client-install Project Keycloak-httpd-client-install

The make_temporary_filename function in perltidy 20120701-1 and previous versions allows local users to obtain sensitive information or write to arbitrary files via a symlink attack, related to use of the tmpnam function.

Perltidy Project Perltidy

Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote malicious users to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow.

Squashfs Project Squashfs Fedoraproject Fedora 21 Fedoraproject Fedora 22

squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs ...

Squashfs-tools Project Squashfs-tools 4.5 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Debian Debian Linux 11.0

keycloak-httpd-client-install versions prior to 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users.

Keycloak-httpd-client-install Project Keycloak-httpd-client-install

Todd Miller's sudo version 1.8.20 and previous versions is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.

Sudo Project Sudo

1 EDB exploit3 Github repositories

squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing...

Squashfs-tools Project Squashfs-tools 4.5 Fedoraproject Fedora 34 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Redhat Enterprise Linux 7.0 Redhat Enterprise Linux 8.0 Fedoraproject Fedora 33

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook