Demonstration-of-CVE-2023-38831-via-Reverse-Shell-Execution

CVE-2023-38831 リバースシェルのデモンストレーション このリポジトリには、CVE-2023-38831 のラボ環境でのデモンストレーションに関する PDF サマリーとスクリーンショットが含まれています。この脆弱性により、攻撃者は圧縮ファイルに悪意のあるペイロードを埋め込んで実行できます。この場合、ペイロードはリバースシェルをトリガーします。 内容: summaryreport.pdf: ラボプロセスの詳細な説明 /screenshots: 手順と結果の視覚的な証拠 注意: このリポジトリには、実行可能なコードやマルウェアは含まれていません。...

Astra Linux – Vulnerability in FontForge

Splinefont in FontForge, with a version number of 20230101, allows for command injection through crafted archives or compressed files...

EUVD-2026-49136

The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths e.g., content://zte.com.cn.filer.fileprovider/rootpath, enabling file access with t...

Uncontrolled Resource Consumption

phpoffice/phpspreadsheet is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the Gnumeric reader calling gzdecode on attacker-supplied compressed .gnumeric files without enforcing a decompressed-size limit, which allows an attacker to upload a specially crafted...

Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb

A vulnerability in the dataframe component of gradio-app/gradio version git 98cbcae allows for a zip bomb attack. The component uses pd.readcsv to process input values, which can accept compressed files. An attacker can exploit this by uploading a maliciously crafted zip bomb, leading to a server...

EUVD-2026-37998

AIL framework contains a path traversal vulnerability in the /objects/item/diff endpoint. The endpoint accepts item identifiers through the s1 and s2 query parameters and, prior to the fix, attempted to retrieve and compare item contents without first verifying that both referenced items existed ...

fontforge: command injection via crafted archives or compressed files

Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files...

EUVD-2025-202310

Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20251107.114628 contain the APIs /iaf/ladybug/api/report/storage and /iaf/ladybug/api/report/upload, which allow uploading gzip-compressed XML files with user-controllable conten...

EUVD-2007-2761

Malware in sbrugna...

EUVD-2006-4826

Malware in sbrugna...

EUVD-2020-18153

Malware in sbrugna...

EUVD-2015-9385

Malware in sbrugna...

EUVD-2022-52143

Malicious code in bioql PyPI...

EUVD-2024-2609

Malicious code in bioql PyPI...

EUVD-2024-32094

Malicious code in bioql PyPI...

EUVD-2022-52462

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2022-4883

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on th...

HortusFox 安全漏洞

HortusFox is a free and open source self-hosted plant manager system from HortusFox, Inc. A security vulnerability exists in HortusFox version v4.4, which stems from improper handling of compressed files by the /modules/ImportModule.php component and could lead to arbitrary code execution...

The vulnerability of the aiohttp HTTP client, related to issues with symbolic links when processing static routes that contain files with compressed variants in the FileResponse class, allows a hacker to compromise the vulnerable system.

The vulnerability of the aiohttp HTTP client is related to problems with symbolic links when processing static routes that contain files with compressed variants in the FileResponse class. Exploiting this vulnerability can allow an attacker to compromise the vulnerable system remotely...

CVE-2024-12387

A vulnerability in the binary-husky/gptacademic repository, as of commit git 3890467, allows an attacker to crash the server by uploading a specially crafted zip bomb. The server decompresses the uploaded file and attempts to load it into memory, which can lead to an out-of-memory crash. This iss...