Improper Handling of Windows ::DATA Alternate Data Stream
CWE-69
The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).
We track 3 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 9.1.
How this weakness is prevented
- Implementation: Ensure that the source code correctly parses the filename to read or write to the correct stream.
Latest Improper Handling of Windows ::DATA Alternate Data Stream vulnerabilities
- 8.7 High severity
algernon: Improper Handling of Windows ::DATA Alternate Data Stream
Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext() without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauth
- 9.8 Critical severity
Niagara Framework: Use of Incorrectly-Resolved Name or Reference
Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1,
- 8.8 High severity
jpress: Improper Handling of Windows ::DATA Alternate Data Stream
JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is