3067 matches found
GO-2025-3922 Memory leaks when decoding a corrupted multiple LZMA archives in github.com/ulikunitz/xz
Memory leaks when decoding a corrupted multiple LZMA archives in github.com/ulikunitz/xz...
CLSA-2025-1758101956 Fix CVE(s): CVE-2025-8194
SECURITY UPDATE: defect in 'tarfile' module leads to infinite loop and deadlock in parsing of maliciously crafted tar archives - debian/patches/CVE-2025-8194.patch: Validate archives to ensure member offsets are non-negative - CVE-2025-8194...
cpython: Cpython infinite loop when parsing a tarfile
A flaw was found in the Python tarfile module. Processing a specially crafted tar archive, specifically an archive with negative offsets, can cause an infinite loop and deadlock. This issue results in a denial of service in the Python application using the tarfile module...
SUSE-SU-2025:20749-1 Security update for python311
This update for python311 fixes the following issues: - CVE-2025-8194: Fixed tar archives with negative offsets leading to infinite loop and deadlock bsc1247249...
Security update for python311
This update for python311 fixes the following issues: CVE-2025-8194: Fixed tar archives with negative offsets leading to infinite loop and deadlock bsc1247249 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...
Ubuntu 24.04 LTS / 25.04 : Vim vulnerabilities (USN-7748-1)
The remote Ubuntu 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7748-1 advisory. It was discovered that Vim incorrectly handled file extraction when opening maliciously crafted zip or tar archives. An attacker could possibly u...
EulerOS Virtualization 2.13.1 : vim (EulerOS-SA-2025-2184)
According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the :redir ex command t...
USN-7748-1: Vim vulnerabilities
It was discovered that Vim incorrectly handled file extraction when opening maliciously crafted zip or tar archives. An attacker could possibly use this issue to create or overwrite files on the system and execute arbitrary code...
USN-7748-1 vim vulnerabilities
It was discovered that Vim incorrectly handled file extraction when opening maliciously crafted zip or tar archives. An attacker could possibly use this issue to create or overwrite files on the system and execute arbitrary code...
APTSimulator
This is a toolset for simulating an APT Advanced Persistent Threat attack on a Windows system. The tool, called APT Simulator, is a Windows Batch script that uses a set of tools and output files to make a system look as if it was compromised. It is designed to be simple and easy to use, requiring...
CVE-2025-9918
A Path Traversal vulnerability in the archive extraction component in Google SecOps SOAR Server versions 6.3.54.0, 6.3.53.2, and all prior versions allows an authenticated attacker with permissions to import Use Cases to achieve Remote Code Execution RCE via uploading a malicious ZIP archive...
CVE-2025-44595
Halo v2.20.17 and before is vulnerable to Cross Site Scripting XSS in /halohost/archives/name...
Protection Mechanism Failure
Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Protection Mechanism Failure when processing ZIP files. An attacker can bypass detection of malicious payloads by crafting ZIP archives with...
Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check
Summary Picklescan's ability to scan ZIP archives for malicious pickle files is compromised when the archive contains a file with a bad Cyclic Redundancy Check CRC. Instead of attempting to scan the files within the archive, whatever the CRC is, Picklescan fails in error and returns no results...
GHSA-MJQP-26HC-GRXG Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check
Summary Picklescan's ability to scan ZIP archives for malicious pickle files is compromised when the archive contains a file with a bad Cyclic Redundancy Check CRC. Instead of attempting to scan the files within the archive, whatever the CRC is, Picklescan fails in error and returns no results...
Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports
Summary The vulnerability allows malicious actors to bypass PickleScan's unsafe globals check, leading to potential arbitrary code execution. The issue stems from PickleScan's strict check for full module names against its list of unsafe globals. By using subclasses of dangerous imports instead o...
PT-2025-37046
Name of the Vulnerable Software and Affected Versions: AxxonSoft Axxon One versions prior to 2.0.8 Description: The Object Archive component in AxxonSoft Axxon One lacks encryption of sensitive data at rest. This allows a local attacker with access to exported storage or stolen physical drives to...
CVE-2025-44595
Halo v2.20.17 and earlier is vulnerable to Cross-Site Scripting (XSS) through the /halo_host/archives/{name} endpoint. The issue affects the handling of the name parameter and can allow script injection. Multiple sources confirm the affected versions are prior to v2.20.17, with a suggested remedi...
PT-2025-36959
Name of the Vulnerable Software and Affected Versions: Halo versions prior to v2.20.17 Description: Halo is susceptible to a Cross Site Scripting XSS issue in the /halo host/archives/name API endpoint. The vulnerability resides in the handling of the name parameter, allowing for potential script...
