The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Path Traversal
Node.js
Decompress
NVD
GitHub
CVSS 3.1
9.8
EPSS
2.1%
Avira Antivirus before 5.0.2003.1821 on Windows allows privilege escalation or a denial of service via abuse of a symlink. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Privilege Escalation
Denial Of Service
Microsoft
Antivirus
Avira
NVD
CVSS 3.1
7.8
EPSS
0.4%