CVE-2025-65345

CVE-2025-65345 – laravel-file-manager v3.3.1 における ZIP 機能を介した認証済みパストラバーサルによるファイルシステム情報漏えい 🧭 概要 laravel-file-manager v3.3.1 以下には、認証済みディレクトリトラバーサル Directory Traversal の脆弱性が存在します。ファイルマネージャーインターフェースにアクセスできる攻撃者が、不適切なパス検証により、zip/アーカイブ機能を使用して、意図された範囲外のファイルやディレクトリを含むアーカイブを作成できる可能性があります。 🧱 影響を受けるコンポーネント...

CVE-2025-13681

The BFG Tools – Extension Zipper plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.7. This is due to insufficient input validation on the user-supplied firstfile parameter in the zip function. This makes it possible for authenticated attackers, with...

CVE-2025-13681

The BFG Tools – Extension Zipper plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.7. This is due to insufficient input validation on the user-supplied firstfile parameter in the zip function. This makes it possible for authenticated attackers, with...

CVE-2025-13681: Improper Limitation of a Pathname to a Restricted Directory

The BFG Tools – Extension Zipper plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.7. This is due to insufficient input validation on the user-supplied firstfile parameter in the zip function. This makes it possible for authenticated attackers, with...

Exploit for CVE-2025-65345

CVE-2025-65345 – Authenticated Path Traversal From Zip Functio...

EUVD-2017-0147

Malware in sbrugna...

EUVD-2020-0031

Malware in sbrugna...

CVE-2024-13941 ouch-org ouch zip.rs convert_zip_date_time memory corruption

A vulnerability was found in ouch-org ouch up to 0.3.1. It has been classified as critical. This affects the function ouch::archive::zip::convertzipdatetime of the file zip.rs. The manipulation of the argument month leads to memory corruption. The attack needs to be approached locally. The exploi...

PT-2024-31900 · Unknown · Scriptcase

Name of the Vulnerable Software and Affected Versions: Scriptcase versions 9.10.023 and earlier Description: The issue is a Remote Code Execution RCE vulnerability caused by the nm zip function. This allows for remote code execution, potentially leading to unauthorized access and control of the...

MGASA-2020-0217 Updated ansible packages fix security vulnerabilities

Updated ansible package fixes security vulnerabilities: A race condition flaw was found in Ansible Engine when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with...

RHEL 7 : Ansible security update (2.7.17) (Important) (RHSA-2020:1544)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1544 advisory. Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH a...