649 matches found
CVE-2025-65025 esm.sh CDN service has arbitrary file write via tarslip
esm.sh is a nobuild content delivery networkCDN for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths e.g.,...
CVE-2025-65025 esm.sh CDN service has arbitrary file write via tarslip
esm.sh is a nobuild content delivery networkCDN for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths e.g.,...
CVE-2025-65025 esm.sh CDN service has arbitrary file write via tarslip
esm.sh is a nobuild content delivery networkCDN for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths e.g.,...
PT-2025-47503
Name of the Vulnerable Software and Affected Versions esm.sh versions prior to 136 Description The esm.sh CDN service is susceptible to a path traversal issue during the extraction of NPM package tarballs. An attacker can create a malicious NPM package with crafted file paths, such as...
Symlink Validation Bypass
tar-fs is vulnerable to symlink validation bypass. The vulnerability is due to improper validation of symbolic links during tar extraction, which allows an attacker to overwrite arbitrary files if the destination directory is predictable with a crafted tarball...
Keras 安全漏洞
Keras is a multi-backend deep learning framework open-sourced by Keras. A security vulnerability exists in Keras that stems from the keras.utils.getfile API not using the filter=data function when processing tarballs, which could lead to path traversal attacks...
tar-fs: tar-fs symlink validation bypass
A symlink validation bypass flaw has been discovered in the npm tar-fs library. Affected versions are vulnerable to a symlink validation bypass if the destination directory is predictable with a specific tarball...
java-17-openjdk security update
1:17.0.17.0.10-1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:17.0.17.0.10-1 - Update to jdk-17.0.17+10 GA - Add to .gitignore openjdk-17.0.17+10.tar.xz - Set buildver to 10 - Set rpmrelease to 1, remove 'must start at 2' comment - Set isga to 1 - Update sources to openjdk-17.0.17+10.tar.xz...
tar-fs: tar-fs symlink validation bypass
A symlink validation bypass flaw has been discovered in the npm tar-fs library. Affected versions are vulnerable to a symlink validation bypass if the destination directory is predictable with a specific tarball...
EUVD-2013-7100
Malware in sbrugna...
EUVD-2010-5301
Malware in sbrugna...
EUVD-2009-4000
Malware in sbrugna...
EUVD-2013-6690
Malware in sbrugna...
EUVD-2019-0484
Malware in sbrugna...
EUVD-2019-0468
Malware in sbrugna...
EUVD-2019-0483
Malware in sbrugna...
EUVD-2022-0806
Malicious code in bioql PyPI...
EUVD-2024-36466
Malicious code in bioql PyPI...