KDE Ark 安全漏洞

KDE Ark is a graphical file compression/decompression utility for the KDE community. A security vulnerability exists in KDE Ark versions prior to 24.12.0, which stems from the fact that libarchiveplugin.cpp can extract absolute paths from archives...

GHSA-JCRP-X7W3-FFMG Deep Java Library path traversal issue

Summary Deep Java Library DJL is an open-source, high-level, engine-agnostic Java framework for deep learning. DJL is designed to be easy to get started with and simple to use for Java developers. DJL provides a native Java development experience and functions like any other regular Java library...

PT-2025-4075

Name of the Vulnerable Software and Affected Versions Deep Java Library DJL versions 0.1.0 through 0.31.0 Description A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library DJL on all platforms allows a bad actor to write files to arbitrary locations. This issue exists d...

CVE-2025-23011

Fedora Repository 3.8.1 allows path traversal when extracting uploaded archives "Zip Slip". A remote, authenticated attacker can upload a specially crafted archive that will extract an arbitrary JSP file to a location that can be executed by an unauthenticated GET request. Fedora Repository 3.8.1...

BIT-PHP-MIN-2020-7063 Files added to tar with Phar::buildFromIterator have all-access permissions

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator function, the files are added with default permissions 0666, or all access even if the original files on the filesystem were with more restrictive permissions...

CVE-2025-0227

CVE-2025-0227 affects Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). A vulnerability in the file /Logs/Annals/downLoad.html stems from manipulation of the path argument, resulting in information disclosure. The issue can be triggered remotely, and public exploit information exist...

CVE-2025-0227 Tsinghua Unigroup Electronic Archives System downLoad.html information disclosure

A vulnerability, which was classified as problematic, was found in Tsinghua Unigroup Electronic Archives System 3.2.21080262532. This affects an unknown part of the file /Logs/Annals/downLoad.html. The manipulation of the argument path leads to information disclosure. It is possible to initiate t...

CVE-2025-0226 Tsinghua Unigroup Electronic Archives System downLoad.html download information disclosure

A vulnerability, which was classified as problematic, has been found in Tsinghua Unigroup Electronic Archives System 3.2.21080262532. Affected by this issue is the function download of the file /collect/PortV4/downLoad.html. The manipulation of the argument path leads to information disclosure. T...

CVE-2025-0225 Tsinghua Unigroup Electronic Archives System exampleDownload.html path traversal

A vulnerability classified as problematic was found in Tsinghua Unigroup Electronic Archives System 3.2.21080262532. Affected by this vulnerability is an unknown functionality of the file /setting/ClassFy/exampleDownload.html. The manipulation of the argument name leads to path traversal:...

CVE-2025-0225

The CVE-2025-0225 entry concerns Tsinghua Unigroup Electronic Archives System version 3.2.210802(62532). Affected is the file /setting/ClassFy/exampleDownload.html; attacker can manipulate the name argument to perform path traversal (e.g., ../filedir) remotely. Public exploits have been disclosed...

Tsinghua Unigroup Archives Management System 访问控制错误漏洞

Tsinghua Unigroup Archives Management System is an electronic archives management system software from Tsinghua Unigroup China. An access control error vulnerability exists in Tsinghua Unigroup Archives Management System version 3.2.21080262532, which originates from the parameter path in the fil...

Tsinghua Unigroup Archives Management System 安全漏洞

Tsinghua Unigroup Archives Management System is an electronic archives management system software from Tsinghua Unigroup China. A security vulnerability exists in Tsinghua Unigroup Archives Management System version 3.2.21080262532, which originates from a path traversal caused by the parameter...

Tsinghua Unigroup Archives Management System 访问控制错误漏洞

Tsinghua Unigroup Archives Management System is an electronic archives management system software from Tsinghua Unigroup China. An access control error vulnerability exists in Tsinghua Unigroup Archives Management System version 3.2.21080262532, which originates from the parameter path in the fil...

CVE-2024-13042

CVE-2024-13042 affects Tsinghua Unigroup Electronic Archives Management System 3.2.210802(62532). The vulnerability is in the download function at /Searchnew/Subject/download.html where manipulation of the argument path enables information disclosure. It is exploitable remotely, and public PoC/pu...

Tsinghua Unigroup Archives Management System 访问控制错误漏洞

Tsinghua Unigroup Archives Management System is an electronic archives management system software from China's Tsinghua Unigroup. An access control error vulnerability exists in Tsinghua Unigroup Archives Management System version 3.2.21080262532, which stems from an incorrect operation of the...

php: phar Buffer mismanagement

A flaw was found in PHP that can lead to a buffer overflow and a stack information leak due to improper bounds checking within the phardirread function. This issue may allow an attacker to initiate memory corruption by compelling the application to open a specially crafted .phar archive, allowing...

Horns&Hooves campaign delivers NetSupport RAT and BurnsRAT

Recent months have seen a surge in mailings with lookalike email attachments in the form of a ZIP archive containing JScript scripts. The script files – disguised as requests and bids from potential customers or partners – bear names such as "Запрос цены и предложения от Индивидуального...

PT-2024-40946 · Ruzstd · Ruzstd

Name of the Vulnerable Software and Affected Versions: ruzstd affected versions not specified Description: The issue arises from miscalculations in the length of the allocated and init section of the internal RingBuffer in ruzstd. This leads to uninitialized or out-of-bounds reads in copy bytes...

CVE-2024-50377

A CWE-798 "Use of Hard-coded Credentials" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G = 1.6.3, EKI-6333AC-2GD = v1.6.3 and EKI-6333AC-1GPO = v1.2.1. The vulnerability is associated to the backup configuration functionality that by default encrypts the...

Astra Linux – Vulnerability in Python 3.11

There is a medium-severity vulnerability affecting CPython. Regular expressions that allow excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS through specifically crafted tar archives...