symantec endpoint protection log4j vulnerability

An archive containing absolute paths or paths that try to traverse 'upwards' using '.' sequences can then write files to any location on the local fie system that the user executing Ivy has write access to. For artifacts using the 'zip', 'jar' or 'war' packaging Ivy prior to 2.5.1 doesn't verify the target path when extracting the archive. With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. This issue has been patched in version 1.4.5. versions prior to 1.4.5 are subject to a Denial of Service when opening zip files with HTML sequences. Jadx is a set of command line and GUI tools for producing Java source code from Android Dex and Apk files. No known workarounds for this issue exist. There are no database configuration changes required when upgrading to this version. This vulnerability is fixed in version 1.0-beta15. In normal QTIWorks Engine deployments, the impact is somewhat reduced because the default QTIWorks configuration does not enable the public demo functionality, so ZIP files can only be uploaded by users with 'instructor' privileges. In extreme cases, this could allow anonymous users to change files in arbitrary locations in the filesystem.

The ZIP handling code does not sufficiently check the paths of files contained within ZIP files, so can insert files into other locations in the filesystem if they are writable by the process running the QTIWorks Engine. Prior to version 1.0-beta15, the QTIWorks Engine allows users to upload QTI content packages as ZIP files.

QTIWorks is a software suite for standards-based assessment delivery. The exploitation of this vulnerability could lead to a remote code injection.Ī zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file. There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the SCORM importer feature. This path traversal could result in remote code execution. ZIP archives containing characters used in path traversal. The exploitation of this vulnerability could lead to a remote code injection.ĭelta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle. There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the plugin upload component.

Symantec endpoint protection log4j vulnerability