The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Node.js
Path Traversal
Decompress
NVD
GitHub
CVSS 3.1
9.8
EPSS
2.1%
Avira Antivirus before 5.0.2003.1821 on Windows allows privilege escalation or a denial of service via abuse of a symlink. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Denial Of Service
Privilege Escalation
Microsoft
Antivirus
NVD
CVSS 3.1
7.8
EPSS
0.4%