12107 matches found
CVE-2025-70952
pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation...
CVE-2025-70952
pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation...
Directory Traversal
Overview @astrojs/internal-helpers is an Internal helpers used by core Astro packages. Affected versions of this package are vulnerable to Directory Traversal in the matchPathname method. An attacker can access unauthorized paths in the /image endpoint by crafting a remote URL that includes an...
CVE-2026-32853 LibVNCServer UltraZip Encoding Heap Out-of-bounds Read
LibVNCServer versions 0.9.15 and prior fixed in commit 009008e contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the...
CVE-2026-32853
LibVNCServer versions 0.9.15 and prior fixed in commit 009008e contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the...
CVE-2026-32853
LibVNCServer versions 0.9.15 and prior fixed in commit 009008e contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the...
Allocation of Resources Without Limits or Throttling
Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the File Manager’s bulk download functionality due to improper memory management when creating zip archives. An attacker can cau...
CVE-2026-30662
ConcreteCMS v9.4.7 contains a Denial of Service DoS vulnerability in the File Manager component. The 'download' method in 'concrete/controllers/backend/file.php' improperly manages memory when creating zip archives. It uses 'ZipArchive::addFromString' combined with 'filegetcontents', which loads...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via the pathfor function in DiskService. An attacker can read, write, or delete arbitrary files on the server by supplying blob keys containing path traversal sequences like ../. Note: In most cases, blob keys are...
concretecms 资源管理错误漏洞
ConcreteCMS is an open-source content management system developed by Concrete. Version 9.4.7 of ConcreteCMS contains a vulnerability related to resource management. This vulnerability stems from improper memory management during the creation of zip archives by the file manager component, which ma...
CVE-2026-30662
ConcreteCMS v9.4.7 is affected by a DoS in the File Manager’s download path. The vulnerability resides in the download() method of concrete/controllers/backend/file.php, which uses ZipArchive::addFromString in combination with file_get_contents, causing PHP to load the full contents of all select...
CVE-2026-30662
ConcreteCMS v9.4.7 contains a Denial of Service DoS vulnerability in the File Manager component. The 'download' method in 'concrete/controllers/backend/file.php' improperly manages memory when creating zip archives. It uses 'ZipArchive::addFromString' combined with 'filegetcontents', which loads...
Alibaba Cloud Linux 3 : 0060: container-tools (ALINUX3-SA-2026:0060)
The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0060 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-61726: The net/url package does n...
PT-2026-27435
ConcreteCMS v9.4.7 contains a Denial of Service DoS vulnerability in the File Manager component. The 'download' method in 'concrete/controllers/backend/file.php' improperly manages memory when creating zip archives. It uses 'ZipArchive::addFromString' combined with 'file get contents', which load...
CVE-2026-28483
Rejected reason: This CVE ID has been rejected...
CVE-2026-28483
OpenClaw before 2026.3.2 is affected by a race condition in ZIP extraction. The vulnerability arises from a gap between path validation and file write operations in src/infra/archive.ts, allowing a local attacker to write files outside the intended extraction root by abusing parent-directory syml...
EUVD-2026-14561
OpenClaw before 2026.3.2 contains a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended destination directory via parent-directory symlink rebind between path validation and file write operations. Attackers can exploit the gap between...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal due to improper validation of user-supplied input when paths are not normalized. An attacker can gain unauthorized access to protected resources by crafting specially constructed path traversal sequences. Details A...
Directory Traversal
Overview github.com/ory/oathkeeper/proxy is an Identity & Access Proxy IAP and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules Affected versions of this package are vulnerable to Directory Traversal due to improper validation of user-supplied input when pat...