Commvault CVE-2025-34028 Added to CISA KEV After Active Exploitation Confirmed

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added a maximum-severity security flaw impacting Commvault Command Center to its Known Exploited Vulnerabilities KEV catalog, a little over a week after it was publicly disclosed. The vulnerability in question is CVE-2025-34028 CV...

Mobile Security Framework 安全漏洞

Mobile Security Framework MobSF is an automated all-in-one mobile application open-sourced by Mobile Security Framework. Used for penetration testing, malware analysis and security assessments, it is capable of performing both static and dynamic analysis. A security vulnerability exists in Mobile...

PT-2025-19792

Name of the Vulnerable Software and Affected Versions MobSF versions up to and including 4.3.2 Description MobSF is a mobile application security testing tool used by security teams across numerous organizations, typically deployed on centralized internal or cloud-based servers. The tool provides...

The vulnerability of 7-Zip, related to errors in the certificate validation process, allows attackers to compromise the integrity of the protected information.

The vulnerability of 7-Zip archiver is related to errors in the certificate validation process. Exploiting this vulnerability allows an attacker to compromise the integrity of the protected information using a specially created xz file...

The vulnerability of 7-Zip, related to errors in the certificate validation process, allows attackers to compromise the integrity of the protected information.

The vulnerability of 7-Zip archiver is related to errors in the certificate validation process. Exploiting this vulnerability allows an attacker to compromise the integrity of the protected information using a specially created xz file...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the path parameters in the /demo/static/ endpoint. An attacker can exploit this vulnerability to read arbitrary files from the server’s filesystem by manipulating the request path, potentially exposing sensitive...

The vulnerability of the Mark-of-the-Web protection mechanism in the 7-Zip archive viewer allows a hacker to execute arbitrary code.

The vulnerability of the Mark-of-the-Web protection mechanism in the 7-Zip archive extractor is related to a breach of the data protection mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code during the decompression of the archive by the user, where the archive...

📄 unzip-stream 0.3.1 Arbitrary File Write

unzip-stream version 0.3.1 suffers from an arbitrary file write vulnerability. Exploit Title: unzip-stream 0.3.1 - Arbitrary File Write Date: 18th April, 2024 Exploit Author: Ardayfio Samuel Nii Aryee Software link: https://github.com/mhr3/unzip-stream Version: unzip-stream 0.3.1 Tested on: Ubunt...

ROS-20250430-06

A vulnerability in the vim text editor function is related to the execution of shell commands via specially crafted tar archives. created tar archives. Exploitation of the vulnerability could allow an attacker to execute arbitrary commands A vulnerability in the vim text editor function is relate...

CVE-2022-47112

7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Some later versions are unaffected...

CVE-2022-47111

7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits. Some later versions are unaffected...

[SECURITY] Fedora 42 Update: xz-5.8.1-2.fc42

XZ Utils are an attempt to make LZMA compression easy to use on free as in freedom operating systems. This is achieved by providing tools and libraries which are similar to use than the equivalents of the most popular existing compression algorithms. LZMA is a general purpose compression algorith...

CVE-2025-34028

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP. This issue affec...

SUSE CVE-2017-13670

In BlackCat CMS 1.2, remote authenticated users can upload any file via the media upload function in backend/media/ajaxupload.php, as demonstrated by a ZIP archive that contains a .php file...

Commvault Command Center 11.38 < 11.38.20 RCE (CV_2025_04_1)

An arbitrary code execution vulnerability in Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files, which, when expanded by the target server, result in Remote Code Execution. Note that Nessus has not tested for this issue but has instead relied only on t...

Critical Commvault Command Center Flaw Enables Attackers to Execute Code Remotely

A critical security flaw has been disclosed in the Commvault Command Center that could allow arbitrary code execution on affected installations. The vulnerability, tracked as CVE-2025-34028 , carries a CVSS score of 9.0 out of a maximum of 10.0. "A critical security vulnerability has been...

PT-2025-29940

Name of the Vulnerable Software and Affected Versions 7-Zip versions prior to 25.0.0 Description 7-Zip is a file archiver with a high compression ratio. A flaw exists in the RAR5 handler where writing zeroes outside of the heap buffer can cause memory corruption and denial of service...

PT-2025-29941

Name of the Vulnerable Software and Affected Versions 7-Zip versions prior to 25.0.0 Description 7-Zip is a file archiver that supports extracting from Compound Documents. A null pointer dereference in the Compound handler may lead to denial of service. Recommendations Update to version 25.0.0 or...

The vulnerability of the NArchive::NZip::CInArchive::FindCd function of the p7zip archive tool can potentially affect the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the NArchive::NZip::CInArchive::FindCd function in the p7zip archive tool is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

Ubuntu: Security Advisory (USN-7454-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...