php:8.1 security update

An update is available for module.php-pecl-apcu, php-pecl-rrd, php-pecl-zip, module.php-pecl-zip, module.php-pecl-rrd, php-pecl-apcu, php-pecl-xdebug3, module.php-pecl-xdebug3. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

NewStart CGSL MAIN 7.02 : golang Multiple Vulnerabilities (NS-SA-2025-0254)

The remote NewStart CGSL host, running version MAIN 7.02, has golang packages installed that are affected by multiple vulnerabilities: - The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2025-992142)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992142 advisory. The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory EOCD Locator record offset value would not be used to locate the ZIP64 EOCD...

CVE-2025-14413

Soda PDF Desktop CBZ File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Soda PDF Desktop. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2025-13700

DreamFactory saveZipFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of DreamFactory. Authentication is required to exploit this vulnerability. The specific flaw exists within the...

The vulnerability of the management server software in G Data Management Server lies in the incorrect limitation of the path to the restricted access directory. This allows attackers to increase their privileges and gain access to modify any arbitrary files.

The vulnerability of the management server software from G Data Management Server is related to incorrect restrictions on the path to the restricted directory. Exploiting this vulnerability can allow an attacker to enhance their privileges and gain access to modify any files using a specially...

Command Injection

Overview dreamfactory/df-core is a DreamFactorytm Core Components Affected versions of this package are vulnerable to Command Injection via the saveZipFile function in the Components/Package/Package.php file. An attacker can execute arbitrary code in the context of the service account by supplyin...

CVE-2025-14413

Soda PDF Desktop CBZ File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Soda PDF Desktop. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2025-14420 pdfforge PDF Architect CBZ File Parsing Directory Traversal Remote Code Execution Vulnerability

pdfforge PDF Architect CBZ File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via improper validation of file paths in the Downloader integration. An attacker can access arbitrary files on the system by supplying crafted path traversal sequences. Details A Directory Traversal attack also known...

Soda PDF Desktop 路径遍历漏洞

Soda PDF Desktop is a full-featured PDF editing software from Soda Canada. Soda PDF Desktop suffers from a path traversal vulnerability that stems from a lack of validation of user-supplied paths when parsing CBZ files, which could lead to directory traversal and remote code execution...

Pdfforge Pdf Architect 路径遍历漏洞

Pdfforge Pdf Architect is a solution for viewing and editing PDF documents from Pdfforge. A path traversal vulnerability exists in Pdfforge Pdf Architect, which stems from a lack of proper validation of user-supplied paths prior to file manipulation when parsing a CBZ file, which could lead to...

Oracle Linux 9 : php:8.3 (ELSA-2025-23309)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-23309 advisory. php 8.3.26-1 - rebase to 8.3.26 php-pecl-apcu 5.1.23-1 - update to 5.1.23 for PHP 8.2 RHEL-14699 5.1.21-1 - update to 5.1.21 for PHP 8.1 2070040...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the TkFiles function. An attacker can access files outside the intended directory by submitting specially crafted HTTP request paths containing directory traversal sequences. Details A Directory Traversal attack...

php:8.3 security update

php 8.3.26-1 - rebase to 8.3.26 php-pecl-apcu 5.1.23-1 - update to 5.1.23 for PHP 8.2 RHEL-14699 5.1.21-1 - update to 5.1.21 for PHP 8.1 2070040 php-pecl-redis6 6.1.0-2 - ignore 1 ONLINE test 6.1.0-1 - RHEL build 6.1.0-1 - update to 6.1.0 - drop patch merged upstream 6.1.0RC2-1 - update to 6.1.0R...

ROS-20251219-7306

A vulnerability in the 7-Zip file archiver is related to incorrect symbolic link detection before accessing a file. Exploitation of the vulnerability could allow an attacker to execute arbitrary code if a user opens a specially generated ZIP archive...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via crafted symbolic links in the repository. An attacker can access sensitive files on the server filesystem by creating and referencing symbolic links that point to arbitrary locations. Details A Directory Traversa...

CVE-2023-53942

File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands through a crafted PHP script with ...

CVE-2023-53942

File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands through a crafted PHP script with ...

CVE-2023-53942 File Thingie 2.5.7 Authenticated Arbitrary File Upload Remote Code Execution

File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands through a crafted PHP script with ...