Archive
17 June 2020
Vulnerabilities first published on this day (UTC), newest first.
4 results · Clear filters · Feed
-
High 7.5
golang.org/x/text Infinite loop
The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder insta…
-
High 7.5
Arbitrary File Write via Archive Extraction (Zip Slip)
In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.
-
High 7.5
Arbitrary File Write via Archive Extraction (Zip Slip)
In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.
-
High 7.2
MJML vulnerable to path traversal
MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document.