Vulnerabilities
6 CVEs · NVD, GitHub Advisories, CISA KEV, FIRST EPSS, GitHub PoC repos
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-39139 +1 in the same advisory: …39137 | An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file. An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file. NVD description · AI analysis pending | 7.8 | <1% | PoC ×2 |
| — | |
| CVE-2023-39136 | An unhandled edge case in the component _sanitizedPath of ZipArchive v2.5.4 allows attackers to cause a Denial of Service (DoS) via a crafted zip file. An unhandled edge case in the component _sanitizedPath of ZipArchive v2.5.4 allows attackers to cause a Denial of Service (DoS) via a crafted zip file. NVD description · AI analysis pending | 5.5 | <1% | PoC ×3 |
| — | |
| CVE-2023-25484 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Oliver Schlöbe Simple Yearly Archive plugin <= 2.1.8 versions. Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Oliver Schlöbe Simple Yearly Archive plugin <= 2.1.8 versions. NVD description · AI analysis pending | 4.8 | <1% |
| — | ||
| CVE-2022-36943 | SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the first item. NVD description · AI analysis pending | 8.1 | <1% | PoC |
| — | |
| CVE-2020-28422 | All versions of package git-archive are vulnerable to Command Injection via the exports function. All versions of package git-archive are vulnerable to Command Injection via the exports function. NVD description · AI analysis pending | 7.8 | <1% |
| — |