WordPress ZIP Code Based Content Protection plugin <= 1.0.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by RoyTdd in WordPress Plugin ZIP Code Based Content Protection versions = 1.0.0...

PT-2025-36531

Name of the Vulnerable Software and Affected Versions: MONAI versions prior to 1.5.1 Description: MONAI Medical Open Network for AI is an AI toolkit for health care imaging. The extractall function zip file.extractalloutput dir is used directly to process compressed files throughout the project...

Security update for 7zip (moderate)

openSUSE Security Update: Security update for 7zip Announcement ID: openSUSE-SU-2025:0339-1 Rating: moderate References: 1246706 1246707 1249130 Cross-References: CVE-2025-53816 CVE-2025-53817 CVSS scores: CVE-2025-53816 SUSE: 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N...

Directory Traversal

Overview internetarchive is an A Python interface to archive.org. Affected versions of this package are vulnerable to Directory Traversal via the download function in the file.py file, which does not properly sanitize user-supplied filenames or validate the final download path. An attacker can...

Exploit for Out-of-bounds Write in 7-Zip

This repository is an exploit module for CVE-2022-29072, a privilege escalation vulnerability in 7-Zip through version 21.07 on Windows. The vulnerability allows an attacker to execute commands with elevated privileges when a file with the .7z extension is dragged to the HelpContents area. The...

7zip-25.01-1.1 on GA media (moderate)

7zip-25.01-1.1 on GA media Announcement ID: openSUSE-SU-2025:15523-1 Rating: moderate Cross-References: CVE-2025-53816 CVE-2025-53817 CVSS scores: CVE-2025-53816 SUSE : 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L CVE-2025-53816 SUSE : 4.8...

Django: Path traversal via archive.extract - CVE 2021-3281 incomplete patch

A vulnerability was discovered in the "extract" function of the ZipArchive and TarArchive classes in the Django framework. The vulnerability was caused by the use of the "abspath" function, which removes terminating path separators. This made the guard logic protection insufficient to protect...

OESA-2025-2098 uv security update

An extremely fast Python package and project manager, written in Rust. Security Fixes: uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's...

VirusTotal Finds 44 Undetected SVG Files Used to Deploy Base64-Encoded Phishing Pages

Cybersecurity researchers have flagged a new malware campaign that has leveraged Scalable Vector Graphics SVG files as part of phishing attacks impersonating the Colombian judicial system. The SVG files, according to VirusTotal, are distributed via email and designed to execute an embedded...

VirusTotal Finds 44 Undetected SVG Files Used to Deploy Base64-Encoded Phishing Pages

Cybersecurity researchers have flagged a new malware campaign that has leveraged Scalable Vector Graphics SVG files as part of phishing attacks impersonating the Colombian judicial system. The SVG files, according to VirusTotal, are distributed via email and designed to execute an embedded...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the base64 path after /download/ endpoint. An attacker can access arbitrary files outside the intended document root by providing a crafted base64-encoded path after the download endpoint, bypassing security...

August Linux Patch Wednesday

AugustLinux Patch Wednesday. I’m late with this LPW since I was improving the generation of LPW bulletin lists and the operation of Vulristics. In August, Linux vendors addressed 867 vulnerabilities, nearly twice July’s total, including 455 in the Linux Kernel. One vulnerability is confirmed...

Directory Traversal

Overview kwik is a Fast, batteries-included, business-oriented, opinionated REST APIs framework Affected versions of this package are vulnerable to Directory Traversal via the kwik.utils.files.storefile function due to improper validation of directory containment in the file upload helper, which...

Mishandling of corrupt central directory record in archive/zip

...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the podman kube play command. An attacker can cause sensitive data corruption and system crashes by supplying a malicious Kubernetes YAML file that results in overwriting critical host files. The attacker only...

CVE-2025-58057 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted...

CVE-2025-58057

CVE-2025-58057 is a Netty vulnerability where, in affected releases of netty-codec-compression (≤ 4.1.124.Final) and netty-codec (≤ 4.2.4.Final), specially crafted input can cause BrotliDecoder and related decoders to allocate a large number of reachable byte buffers, leading to denial of service...

GHSA-3P8M-J85Q-PGMJ Netty's decoders vulnerable to DoS via zip bomb style attack

Summary With specially crafted input, BrotliDecoder and some other decompressing decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. Details BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time...

Netty's decoders vulnerable to DoS via zip bomb style attack

Summary With specially crafted input, BrotliDecoder and some other decompressing decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. Details BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time...

PT-2025-36605

Summary With specially crafted input, BrotliDecoder and some other decompressing decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. Details BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time...