Apple macOS 安全漏洞

Apple macOS is a suite of specialized operating systems developed for Mac computers by Apple Inc. in the United States. A security vulnerability exists in Apple macOS Sequoia that stems from a malicious JAR file that could bypass Gatekeeper checks...

Security Bulletin: Vulnerability in archive/zip affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in archive/zip has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

UBUNTU-CVE-2024-48615

Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function headerpaxextension at rchivereadsupportformattar.c:1844:8...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip in the extract function in extractor.go, which doesn't sufficiently sanitize its input. An attacker can execute arbitrary commands or modify files with the permission of the user by...

GHSA-J95M-RCJP-Q69H github.com/jaredallard/archives Has Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Impact A malicious user could feed a specially crafted archive to this library causing RCE, modification of files or other bad things in the context of whatever user is running this library as, through the program that imports it. The severity highly depends on the user's permissions and...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the headerpaxextension function. An attacker can cause a system crash by providing a specially crafted TAR archive. Remediation Upgrade libarchive to version 3.8.1 or higher. References - GitHub Issue - GitH...

WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin <= 1.3.8.7 - Unauthenticated PHP Object Injection via PHAR to Arbitrary File Deletion vulnerability

Unauthenticated PHP Object Injection via PHAR to Arbitrary File Deletion vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Drag and Drop Multiple File Upload – Contact Form 7 versions = 1.3.8.7...

007putra-my-bot (1.1.1), 10bis-shufersal-automation (1.0.0) +4597 more potentially affected by CVE-2024-12905 via tar-fs (>=2.0.0, <=2.1.1)

tar-fs NPM version =2.0.0, =0.2.0, =1.0.0, =1.0.0, =0.107.10, =1.19.19, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.123.2 and more Source cves: CVE-2024-12905 Source advisory: OSV:GHSA-PQ67-2WWV-3XJX...

GPT Academic Remote Code Execution Vulnerability

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a remote code execution vulnerability that stems from not properly validating a user-supplied RAR file, which can be exploited by an attacker to cause remote...

Mattermost Command Execution Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a command execution vulnerability that stems from unrestricted command execution in an archive channel, which can be exploited by an attacker to run commands in an archive chann...

GPT Academic path traversal vulnerability (CNVD-2025-22739)

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a path traversal vulnerability that stems from an unverified 7z file extraction, which can be exploited by an attacker to perform arbitrary file writes, leadi...

Internet Archive (Archive.org) Goes Down Following “Power Outage” (Updated)

The Internet Archive Archive.org, home to the Wayback Machine, is temporarily offline due to a reported power outage.…...

CVE-2025-30343

A directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in folders. The interface allows users to download a ZIP archive that contains all files in a folder and its subfolders. If an attacker specifies the title of a file o...

OESA-2025-1311 libarchive security update

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use . Security...

OESA-2025-1313 libarchive security update

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use . Security...

CVE-2025-30343

A directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in folders. The interface allows users to download a ZIP archive that contains all files in a folder and its subfolders. If an attacker specifies the title of a file o...

CVE-2025-30343

A directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in folders. The interface allows users to download a ZIP archive that contains all files in a folder and its subfolders. If an attacker specifies the title of a file o...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a command execution vulnerability that stems from unrestricted command execution in an archive channel, which can be exploited by an attacker to run commands in an archive chann...

CVE-2025-30343

Summary: CVE-2025-30343 affects OpenSlides prior to version 4.2.5. Vulnerability: A directory traversal issue in the file upload and ZIP-download feature allows a crafted file/folder title (e.g., ../../../etc/passwd) to be treated as a path during ZIP generation, which may lead to overwriting fil...

CVE-2025-30343

A directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in folders. The interface allows users to download a ZIP archive that contains all files in a folder and its subfolders. If an attacker specifies the title of a file o...