PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2020-27637] CRAN Version 4.0.2 Advisory

bishopfox.com | vulnerability | CVE-2020-27637 | #supply-chain | #path-traversal | #advisory | #cran | #r-language | #cve-2020-27637
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CRAN 4.0.2 path traversal (CVE-2020-27637): malicious R packages abuse tar.gz headers to write outside install directories — overwriting binaries, adding cronjobs, planting SSH keys; fixed in 4.0.3.
CVE
CVE-2020-27637
Published
Collected

Related coverage

vulnerability · bishopfox.com
Oracle WebLogic Node Manager allows arbitrary configuration via UNC path
Bishop Fox advisory: WebLogic Node Manager 10.3.3 and earlier let unauthenticated attackers redirect its config and password files to an attacker-controlled UNC path, then run commands; fixed in 2011.
vulnerability · blog.quarkslab.com
MyReport Updater: From gRPC to SYSTEM
MyReport is a report generation software often used as a component of web-based applications. We describe a privilege escalation and remote code execution vulnerabilities in MyReport Updater 2.1.1 through its update configuration and gRPC service.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
Critical · vulnerability · aikido.dev
Node2Shell Evolves to HTTP2Shell: Google Brotli Flaw (CVE-2026-111497) Affects HTTP Ecosystem
Brotli is ubiquitous across the modern HTTP ecosystem for web asset compression. Because the flaw allows unauthenticated remote code execution in both directions, any service or client automatically decompressing untrusted Brotli payloads is at critical risk until patched.
vulnerability · aikido.dev
Yet another RCE in Gogs, but it's fixed this time!
This vulnerability coverage helps defenders validate exposure and prioritize remediation.
vulnerability · horizon3.ai
CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE
Horizon3 analyzes CVE-2026-106173, a critical FortiSIEM gRPC vulnerability enabling unauthenticated path traversal, arbitrary file writes, and code execution.
Back