iTerm2 Security Vulnerability

iTerm2 is a terminal emulation program written for Mac OS X. A security vulnerability in iTerm2 version 3.5.x prior to 3.5.2, which originates from the unfiltered use of escape sequences to report window titles, allows an attacker to inject arbitrary code into the terminal...

USN-6833-1 vte2.91 vulnerability

Siddharth Dushantha discovered that VTE incorrectly handled large window resize escape sequences. An attacker could possibly use this issue to consume resources, leading to a denial of service...

SUSE-SU-2024:1975-1 Security update for unrar

This update for unrar fixes the following issues: - CVE-2024-33899: Fixed a denial of service via ANSI escape squences. bsc1225661...

SUSE CVE-2000-0476

xterm, Eterm, and rxvt allow an attacker to cause a denial of service by embedding certain escape characters which force the window to be resized...

UBUNTU-CVE-2024-37535

GNOME VTE before 0.76.3 allows an attacker to cause a denial of service memory consumption via a window resize escape sequence, a related issue to CVE-2000-0476...

GHSA-G7HW-JH4P-75WR TYPO3 Cross-Site Scripting in Filelist Module

It has been discovered that the output table listing in the “Files” backend module is vulnerable to cross-site scripting when a file extension contains malicious sequences. Access to the file system of the server - either directly or through synchronization - is required to exploit the...

SUSE-SU-2024:1943-1 Security update for util-linux

This update for util-linux fixes the following issues: - CVE-2024-28085: Properly neutralize escape sequences in wall to avoid potential account takeover. bsc1221831...

CVE-2024-2362

The CVE-2024-2362 entry concerns parisneo/lollms-webui versión 9.3 on Windows, with a path traversal vulnerability in the del_preset endpoint due to inadequate input sanitization. The issue permits an attacker to delete files outside the intended directory by supplying absolute or traversal path...

CLSA-2024-1717691587 Fix CVE(s): CVE-2024-2961

SECURITY UPDATE: buffer overflow in iconv function when converting to ISO-2022-CN-EXT character set - debian/patches/any/CVE-2024-2961.patch: fix out-of-bound writes in ISO-2022-CN-EXT escape sequences - CVE-2024-2961...

ssh: Prefix truncation attack on Binary Packet Protocol (BPP)

A flaw was found in the SSH channel integrity. By manipulating sequence numbers during the handshake, an attacker can remove the initial messages on the secure channel without causing a MAC failure. For example, an attacker could disable the ping extension and thus disable the new countermeasure ...

RHEL 4 : audit (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - Audit: log terminal emulator escape sequences handling CVE-2015-5186 Note that Nessus has not tested for this issue...

RHEL 7 : python-gunicorn (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - python-gunicorn: Improper neutralization of CRLF Sequences http/wsgi.py:processheaders can allow an attacker to cau...

RHEL 6 : audit (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - Audit: log terminal emulator escape sequences handling CVE-2015-5186 Note that Nessus has not tested for this issue...

SUSE CVE-2024-33899

RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences...

GHSA-6XWF-7RFM-4GWC TYPO3 Cross-Site Scripting in Filelist Module

It has been discovered that the output table listing in the “Files” backend module is vulnerable to cross-site scripting when a file extension contains malicious sequences. Access to the file system of the server - either directly or through synchronization - is required to exploit the...

CVE-2024-36052

RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-2024-33899...

CVE-2024-36052

RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-2024-33899...

CVE-2024-36052

RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-2024-33899...

CVE-2024-36052

RARLAB WinRAR versions prior to 7.00 on Windows are vulnerable to an ANSI escape sequence injection flaw (CWE-150 ). This vulnerability allows an attacker to spoof the screen output , potentially misrepresenting critical information to the user. Exploitation of this flaw can also lead to service ...

CVE-2024-36052: Improper Neutralization of Escape, Meta, or Control Sequences

RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-2024-33899...