Jelmer

A path traversal issue exists in the `pop()` function within `stash.py`. The function uses `os.path.exists()` to verify parent directories, which follows symlinks. If an intermediate directory is a symlink pointing outside the worktree, an attacker can write arbitrary files to the filesystem. For example, a malicious repository can be crafted to write a payload into `.git/hooks/post-checkout`, leading to remote code execution during the next checkout operation. The `validate path()` function fails to detect filesystem symlinks, and `build file from blob()` lacks symlink protection.

A path traversal issue exists in the `CommitFilter. apply index filter()` function within `filter branch.py`. The problem occurs because materialized tree entries, including symlinks, persist in the working directory between commit iterations. An attacker can craft a malicious repository where a symlink in an ancestor commit redirects file writes from a descendant commit to arbitrary locations on the filesystem. This can lead to remote code execution if an attacker writes malicious content into the `.git/hooks` directory.

A symlink following issue exists in the `porcelain.checkout(paths=[...])` function. The software uses `os.open` without the `O NOFOLLOW` flag, which allows it to follow symlinks at the target file and intermediate directories. An attacker can craft a malicious repository containing a symlink that points to a sensitive location, such as `.git/hooks/post-checkout`. When a user restores a file from a tag using the affected function, the software may write attacker-controlled content to that location, potentially leading to remote code execution (RCE) when the hook is triggered.

A path traversal issue exists in the checkout logic when running on Windows. The software fails to validate DOS drive letter prefixes in Git tree path elements, which allows an attacker to craft a malicious repository with a tree entry such as `C:`. This bypasses NTFS validation and allows files to be written to absolute paths outside the intended worktree, potentially leading to remote code execution. The issue involves the `validate path element ntfs()` and ` tree to fs path()` functions in `dulwich/index.py`, as well as the ` checked worktree path()` function in `dulwich/porcelain/ init .py`.

The issue is related to an open redirect vulnerability in the aiohttp library, which can allow a remote attacker to conduct phishing attacks using a specially crafted link. This vulnerability is caused by a bug in the `aiohttp.web middlewares.normalize path middleware` middleware.

A directory traversal issue exists in Microsoft cabarc, allowing remote attackers to overwrite files by using "../" sequences in file names within a CAB archive.

The issue allows remote attackers to execute arbitrary code in the Local Security context. This can be achieved by using the `showModalDialog` method and modifying the location to execute code, such as Javascript. The exploitation can occur through delayed HTTP redirect operations or by modifying the `location` attribute of the `window` object.

The issue allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object.

Name of the Vulnerable Software and Affected Versions: Microsoft Windows Media Player 9 Series (affected versions not specified) Description: The issue allows remote attackers to view and manipulate the Media Library on the local system via HTML script. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Media Player version 7.1 Windows Media Player for Windows XP Description: A directory traversal issue allows remote attackers to execute arbitrary code via a skins file with a URL containing hex-encoded backslash characters (%5C) that causes an executable to be placed in an arbitrary location. Recommendations: For Windows Media Player version 7.1, consider disabling the skins feature until a patch is available. For Windows Media Player for Windows XP, restrict access to skins files to minimize the risk of exploitation.

The issue allows remote attackers to automatically upload files from the local system via a web page containing a script to upload the files. This is due to a problem in the file upload control.

The issue concerns a directory traversal vulnerability in UnZip, allowing attackers to overwrite arbitrary files by exploiting invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence. Additionally, there are multiple vulnerabilities in the tar package of Red Hat Linux that can lead to a breach of protected information integrity, and these can be exploited remotely.