rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-2181 
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-30T22:00:00.000Z
CVE-2015-2182 
Multiple cross-site scripting (XSS) vulnerabilities in ZeusCart 4 allow remote attackers to inject arbitrary web script or HTML via the (1) schltr parameter in a brands action or (2) brand parameter in a viewbrands action to index.php.  NOTE: The search parameter vector is already covered by CVE-2010-5322.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-11T14:00:00.000Z
CVE-2015-2183 
Multiple SQL injection vulnerabilities in the administrative backend in ZeusCart 4 allow remote administrators to execute arbitrary SQL commands via the id parameter in a (1) disporders detail or (2) subadminmgt edit action or (3) cid parameter in an editcurrency action to admin/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-10T14:00:00.000Z
CVE-2015-2184 
ZeusCart 4 allows remote attackers to obtain configuration information via a getphpinfo action to admin/, which calls the phpinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-10T14:00:00.000Z
CVE-2015-2186 
The Ansible edxapp role in the Configuration Repo in edX allows remote websites to spoof edX accounts by leveraging use of the string literal "False" instead of a boolean False for the CORS_ORIGIN_ALLOW_ALL setting. Note: this vulnerability was fixed on 2015-03-06, but the version number was not changed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-03T00:00:00.000Z
CVE-2015-2187 
The dissect_atn_cpdlc_heur function in asn1/atn-cpdlc/packet-atn-cpdlc-template.c in the ATN-CPDLC dissector in Wireshark 1.12.x before 1.12.4 does not properly follow the TRY/ENDTRY code requirements, which allows remote attackers to cause a denial of service (stack memory corruption and application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-08T02:00:00.000Z
CVE-2015-2188 
epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 does not properly initialize a data structure, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that is improperly handled during decompression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-08T02:00:00.000Z
CVE-2015-2189 
Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via an invalid Interface Statistics Block (ISB) interface ID in a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-08T02:00:00.000Z
CVE-2015-2190 
epan/proto.c in Wireshark 1.12.x before 1.12.4 does not properly handle integer data types greater than 32 bits in size, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet that is improperly handled by the LLDP dissector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-08T02:00:00.000Z
CVE-2015-2191 
Integer overflow in the dissect_tnef function in epan/dissectors/packet-tnef.c in the TNEF dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-08T02:00:00.000Z
CVE-2015-2192 
Integer overflow in the dissect_osd2_cdb_continuation function in epan/dissectors/packet-scsi-osd.c in the SCSI OSD dissector in Wireshark 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-08T02:00:00.000Z
CVE-2015-2194 
Unrestricted file upload vulnerability in the fusion_options function in functions.php in the Fusion theme 3.1 for Wordpress allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension in a fusion_save action, then accessing it via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-03T19:00:00.000Z
CVE-2015-2195 
Multiple cross-site scripting (XSS) vulnerabilities in the WP Media Cleaner plugin 2.2.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) view, (2) paged, or (3) s parameter in the wp-media-cleaner page to wp-admin/upload.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-03T19:00:00.000Z
CVE-2015-2196 
SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a spiderbigcalendar_month action to wp-admin/admin-ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-03T19:00:00.000Z
CVE-2015-2197 
Cross-site scripting (XSS) vulnerability in the Entity API module before 7.x-1.6 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a field label in the Token API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-03T19:00:00.000Z
CVE-2015-2198 
Multiple cross-site scripting (XSS) vulnerabilities in edit_prefs.php in Beehive Forum 1.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1) homepage_url, (2) pic_url, or (3) avatar_url parameter, which are not properly handled in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-03T19:00:00.000Z
CVE-2015-2199 
Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote authenticated users to execute arbitrary SQL commands via the item[id] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or remote administrators to execute arbitrary SQL commands via the itemid parameter in the (2) wonderplugin_audio_show_item, (3) wonderplugin_audio_show_items, or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-03T19:00:00.000Z
CVE-2015-2201 
Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-05T00:00:00.000Z
CVE-2015-2202 
Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows administrative users to escalate privileges to root on the underlying OS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-05T00:00:00.000Z
CVE-2015-2203 
Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFF_LOGIN permission to obtain sensitive settings history information by leveraging listing of open-ils.pcrud as a controller in the IDL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-01T17:00:00.000Z
CVE-2015-2204 
Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intended access restriction and obtain sensitive information about org unit settings by leveraging failure of open-ils.actor.ou_setting.ancestor_default to enforce view_perm when no auth token is provided.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-01T17:00:00.000Z
CVE-2015-2206 
libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T17:00:00.000Z
CVE-2015-2207 
Multiple cross-site scripting (XSS) vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) ctrl, (2) t90001_0_theform_selection, (3) _scroll, (4) tableName, (5) parent, (6) circuit, (7) return, (8) xname, or (9) mpTransactionId parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-08T17:41:21.000Z
CVE-2015-2208 
The saveObject function in moadmin.php in phpMoAdmin 1.1.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the object parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-12T14:00:00.000Z
CVE-2015-2209 
DLGuard 4.5 allows remote attackers to obtain the installation path via the c parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-04T20:00:00.000Z
CVE-2015-2210 
The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to create a button that spawns a command shell.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-06T21:00:00.000Z
CVE-2015-2213 
SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-09T11:00:00.000Z
CVE-2015-2214 
NetCat 5.01 and earlier allows remote attackers to obtain the installation path via the redirect_url parameter to netshop/post.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-05T15:00:00.000Z
CVE-2015-2215 
Open redirect vulnerability in the Services single sign-on server helper (services_sso_server_helper) module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-05T15:00:00.000Z
CVE-2015-2216 
SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to execute arbitrary SQL commands via the prod_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-05T15:00:00.000Z
CVE-2015-2217 
Multiple cross-site scripting (XSS) vulnerabilities in Ultimate PHP Board (aka myUPB) before 2.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) q parameter to search.php or (2) avatar parameter to profile.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-10T14:00:00.000Z
CVE-2015-2218 
Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) item[name] or (2) item[customcss] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or the itemid parameter in the (3) wonderplugin_audio_show_item or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-05T16:00:00.000Z
CVE-2015-2219 
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service (SUService.exe) through an unspecified named pipe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-12T19:00:00.000Z
CVE-2015-2220 
Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the ninja_forms_field_1 parameter in a ninja_forms_ajax_submit action to wp-admin/admin-ajax.php or (2) remote administrators to inject arbitrary web script or HTML via the fields[1] parameter to wp-admin/post.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-05T16:00:00.000Z
CVE-2015-2221 
ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted y0da cryptor file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-12T19:00:00.000Z
CVE-2015-2222 
ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted petite packed file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-12T19:00:00.000Z
CVE-2015-2223 
Multiple cross-site scripting (XSS) vulnerabilities in the web-based console management interface in Palo Alto Networks Traps (formerly Cyvera Endpoint Protection) 3.1.2.1546 allow remote attackers to inject arbitrary web script or HTML via the (1) Arguments, (2) FileName, or (3) URL parameter in a SOAP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-14T14:00:00.000Z
CVE-2015-2230 
Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-30T19:46:49.000Z
CVE-2015-2233 
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-12T19:00:00.000Z
CVE-2015-2234 
Race condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-12T19:00:00.000Z
CVE-2015-2237 
Multiple SQL injection vulnerabilities in Betster (aka PHP Betoffice) 1.0.4 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) showprofile.php or (2) categoryedit.php or (3) username parameter in a login to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-12T17:00:00.000Z
CVE-2015-2238 
Multiple unspecified vulnerabilities in Google V8 before 4.1.0.21, as used in Google Chrome before 41.0.2272.76, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-2239 
Google Chrome before 41.0.2272.76, when Instant Extended mode is used, does not properly consider the interaction between the "1993 search" features and restore-from-disk RELOAD transitions, which makes it easier for remote attackers to spoof the address bar for a search-results page by leveraging (1) a compromised search engine or (2) an XSS vulnerability in a search engine, a different vulnerability than CVE-2015-1231.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-2241 
Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-12T14:00:00.000Z
CVE-2015-2242 
Multiple SQL injection vulnerabilities in Webshop hun 1.062S allow remote attackers to execute arbitrary SQL commands via the (1) termid or (2) nyelv_id parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T17:00:00.000Z
CVE-2015-2243 
Directory traversal vulnerability in Webshop hun 1.062S allows remote attackers to have unspecified impact via directory traversal sequences in the mappa parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T17:00:00.000Z
CVE-2015-2244 
Multiple cross-site scripting (XSS) vulnerabilities in Webshop hun 1.062S allow remote attackers to inject arbitrary web script or HTML via the (1) param, (2) center, (3) lap, (4) termid, or (5) nyelv_id parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T17:00:00.000Z
CVE-2015-2245 
Huawei Ascend P7 allows remote attackers to cause a denial of service (phone process crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-27T20:00:00.000Z
CVE-2015-2246 
The MeWidget module on Huawei P7 smartphones with software P7-L10 V100R001C00B136 and earlier versions could lead to the disclosure of contact information.
Problem types: description: Information Leakage
Affected products: vendor: n/a
product: P7-L10 V100R001C00B136 and earlier versions
Published: 2017-04-02T20:00:00.000Z
CVE-2015-2247 
Unspecified vulnerability in Boosted Boards skateboards allows physically proximate attackers to modify skateboard movement, cause human injury, or cause physical damage via vectors related to an "injection attack" that blocks and hijacks a Bluetooth signal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-10T17:00:00.000Z
CVE-2015-2248 
Cross-site request forgery (CSRF) vulnerability in the user portal in Dell SonicWALL Secure Remote Access (SRA) products with firmware before 7.5.1.0-38sv and 8.x before 8.0.0.1-16sv allows remote attackers to hijack the authentication of users for requests that create bookmarks via a crafted request to cgi-bin/editBookmark.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-01T15:00:00.000Z
CVE-2015-2249 
Zimbra Collaboration before 8.6.0 patch5 has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-27T18:28:22.000Z
CVE-2015-2250 
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) banned_word[] parameter to index.php/dashboard/system/conversations/bannedwords/success, (2) channel parameter to index.php/dashboard/reports/logs/view, (3) accessType parameter to index.php/tools/required/permissions/access_entity, (4) msCountry parameter to index.php/dashboard/system/multilingual/setup/load_icon, arHandle parameter to (5) design/submit or (6) design in index.php/ccm/system/dialogs/area/design/submit, (7) pageURL to index.php/dashboard/pages/single, (8) SEARCH_INDEX_AREA_METHOD parameter to index.php/dashboard/system/seo/searchindex/updated, (9) unit parameter to index.php/dashboard/system/optimization/jobs/job_scheduled, (10) register_notification_email parameter to index.php/dashboard/system/registration/open/1, or (11) PATH_INFO to index.php/dashboard/extend/connect/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-15T18:00:00.000Z
CVE-2015-2251 
The DeviceManager in Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to obtain sensitive information via a crafted UDS patch with JavaScript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T16:00:00.000Z
CVE-2015-2252 
Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root privileges via a crafted UDS patch with shell scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T16:00:00.000Z
CVE-2015-2253 
The XML interface in Huawei OceanStor UDS devices with software before V100R002C01SPC102 allows remote authenticated users to obtain sensitive information via a crafted XML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T16:00:00.000Z
CVE-2015-2254 
Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to capture and change patch loading information resulting in the deletion of directory files and compromise of system functions when loading a patch.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-13T16:00:00.000Z
CVE-2015-2255 
Huawei AR1220 routers with software before V200R005SPH006 allow remote attackers to cause a denial of service (board reset) via vectors involving a large amount of traffic from the GE port to the FE port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T16:00:00.000Z
CVE-2015-2263 
Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configuration directory when starting YARN NodeManager, which allows local users to obtain sensitive information by reading the files, as demonstrated by yarn.keytab or ssl-server.xml in /var/run/cloudera-scm-agent/process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T20:00:00.000Z
CVE-2015-2264 
Multiple untrusted search path vulnerabilities in (1) EQATEC.Analytics.Monitor.Win32_vc100.dll and (2) EQATEC.Analytics.Monitor.Win32_vc100-x64.dll in Telerik Analytics Monitor Library before 3.2.125 allow local users to gain privileges via a Trojan horse (a) csunsapi.dll, (b) swift.dll, (c) nfhwcrhk.dll, or (d) surewarehook.dll file in an unspecified directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-13T01:00:00.000Z
CVE-2015-2265 
The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-24T17:00:00.000Z
CVE-2015-2266 
message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/site:readallmessages capability before accessing arbitrary conversations, which allows remote authenticated users to obtain sensitive personal-contact and unread-message-count information via a modified URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-01T19:00:00.000Z
CVE-2015-2267 
mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass intended access restrictions and extract archives to arbitrary directories via a crafted dataroot value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-01T19:00:00.000Z