GO-2025-3363 Karmada Tar Slips in CRDs archive extraction in github.com/karmada-io/karmada

Karmada Tar Slips in CRDs archive extraction in github.com/karmada-io/karmada...

CVE-2024-56514 Karmada Tar Slips in CRDs archive extraction

Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTPs URL to retrieve the custom resourc...

PT-2025-42737

Name of the Vulnerable Software and Affected Versions golang versions 1.15 golang versions 1.19 Description An issue exists in the archive/tar package within golang that involves an unbounded allocation during the parsing of GNU sparse map files. This can lead to excessive memory consumption and...

June 25, 2024—KB5039302 (OS Builds 22621.3810 and 22631.3810) Preview

June 25, 2024—KB5039302 OS Builds 22621.3810 and 22631.3810 Preview Applies To Windows 11 version 22H2, all editions Windows 11 version 23H2, all editions Note For information about Windows update terminology, see the article about the types of Windows updates and the monthly quality update types...

PT-2026-2480

Name of the Vulnerable Software and Affected Versions Go net/url package affected versions not specified Description The net/url package does not limit the number of query parameters, potentially leading to excessive memory consumption when parsing large URL-encoded forms with many unique query...

PT-2026-2481

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.24.12 Go versions prior to 1.25.6 Description The Go programming language contains a flaw in the archive/zip functionality that can lead to denial-of-service. Specifically, crafted ZIP files can trigger super-linear...

PT-2025-32526 · Keras +1 · Keras +1

Name of the Vulnerable Software and Affected Versions: Keras versions 3.0.0 through 3.10.0 Description: A safe mode bypass vulnerability exists in the Model.load model method. This allows an attacker to achieve arbitrary code execution by convincing a user to load a specially crafted .keras model...

PT-2026-2490

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.26 Release Candidate 3 Description The issue resides within the crypto/tls package, specifically during TLS session resumption. If the underlying Config object has its ClientCAs or RootCAs fields modified between the...

Exploit for Insufficient Verification of Data Authenticity in Rarlab Winrar

CVE-2023-38831 WinRAR Exploit PoC This repository contains a...

LinkAce security vulnerabilities

LinkAce is a self-hosted archive of links to your favorite websites by Kevin Woblick Personal Developer. A security vulnerability exists in LinkAce versions prior to 1.15.6 that stems from user input that is not properly cleaned or encoded before being reflected in an HTML response. An attacker...

Malicious code in filecraft (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3d0eec02526b659b5e856c211e05be1842dc283ed0b7d07dc90574ea5c7dc34a During the installation, the package iterates its files and attempts to import a hidden module - which is embedded as ZIP archive in the image file --- Categor...

Malicious code in handyfiles (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 381cd796d4e5fce8fb62c337374b5303e0b2466d67467efc95cbc4d7d8248dd4 During the installation, the package iterates its files and attempts to import a hidden module - which is embedded as ZIP archive in the image file --- Categor...

Arbitrary File Write

Luigi is vulnerable to Arbitrary File Write. The vulnerability is due to improper destination file path validation in the extractpackagesarchive function, which allows attackers to craft malicious archive files with paths that traverse outside the intended extraction directory...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server Liberty may affect IBM Storage Protect Backup-Archive Client

Summary IBM Storage Protect Backup-Archive Client can be affected by security flaws in IBM WebSphere Application Server Liberty. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information, as described in the "Vulnerability...

CLSA-2024-1734642829 python3.9: Fix of CVE-2024-0450

CVE-2024-0450: Reject zip archives with overlapping entries to prevent quoted- overlap zip-bombs...

NUUO NVRmini2 Devices Missing Authentication Vulnerability

NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users...

clamav:clamav_scanmap_ARCHIVE_fuzzer: Heap-use-after-free in LzmaDec_Free

Project: https://github.com/Cisco-Talos/clamav.git Detailed Report: https://oss-fuzz.com/testcase?key=5132088386322432 Project: clamav Fuzzing Engine: libFuzzer Fuzz Target: clamavscanmapARCHIVEfuzzer Job Type: libfuzzerasanclamav Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash...

Sensitive Information Exposure

github.com/argoproj/argo-workflows/v3 is vulnerable to a Sensitive Information Exposure. The vulnerability is due to the absence of proper authentication checks in the GET Workflow endpoint when retrieving Archived Workflows. Specifically, when using --auth-mode=client, fake or spoofed tokens can...

CLSA-2024-1734368090 php: Fix of CVE-2023-3824

CVE-2023-3824: Update length checking in PHAR directory entries reading to prevent stack buffer overflow and potential memory corruption or RCE...

CVE-2024-53142

In the Linux kernel, the following vulnerability has been resolved: initramfs: avoid filename buffer overrun The initramfs filename field is defined in Documentation/driver-api/early-userspace/buffer-format.rst as: 37 cpiofile := ALGN4 + cpioheader + filename + "\0" + ALGN4 + data ... 55...