diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 3addf0844167..302695f30df4 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -76,6 +76,37 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + dino -- Path traversal in Dino file transfers + + + dino + 0.2.1 + + + + +

Dino team reports:

+
+

It was discovered that when a user receives and downloads + a file in Dino, URI-encoded path separators in the file name + will be decoded, allowing an attacker to traverse + directories and create arbitrary files in the context of the + user.

+
+ + + + CVE-2021-33896 + https://marc.info/?l=oss-security&m=162308719412719 + https://dino.im/security/cve-2021-33896/ + + + 2021-06-07 + 2021-06-08 + + + pglogical -- shell command injection in pglogical.create_subscription()