SUSE CVE-2007-3377

Header.pm in Net::DNS before 0.60, a Perl module, 1 generates predictable sequence IDs with a fixed increment and 2 can use the same starting ID for all child processes of a forking server, which allows remote attackers to spoof DNS responses, as originally reported for qpsmtp and spamassassin...

SUSE CVE-2011-3377

The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy SOP and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a...

CVE-2022-3377

creationtimestamp| type| source ---|---|--- 2022-11-16 07:51:51+00:00| seen| https://t.me/cibsecurity/52979...

CVE-2022-3377

Horner Automation's Cscape version 9.90 SP 6 and prior does not properly validate user-supplied data. If a user opens a maliciously formed FNT file, then an attacker could execute arbitrary code within the current process by accessing an uninitialized pointer, leading to an out-of-bounds memory...

CVE-2022-3377

Summary: CVE-2022-3377 affects Horner Automation’s Cscape, specifically versions 9.90 SP 6 and prior. The issue is an improper validation of user-supplied data when opening a maliciously formed FNT file, leading to an out-of-bounds memory read due to an uninitialized pointer and potentially arbit...

CVE-2022-3377

Horner Automation's Cscape version 9.90 SP 6 and prior does not properly validate user-supplied data. If a user opens a maliciously formed FNT file, then an attacker could execute arbitrary code within the current process by accessing an uninitialized pointer, leading to an out-of-bounds memory...

CVE-2015-3377

...

CVE-2015-3377

CVE-2015-3377 is rejected/not used and does not represent an active vulnerability entry.

GHSA-P94C-R74J-43QG ChakraCore RCE Vulnerability

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3377...

@aarnet/jupyterlab-ext-aarnet-help (=0.1.0), @aarnet/jupyterlab-ext-changeconf (>=0.1.0 <=0.1.1) +612 more potentially affected by CVE-2021-3377 via ansi_up (>=1.3.0 <=4.0.4)

ansiup NPM version =1.3.0, =0.1.0, =0.19.1-rc.2, =0.19.1-rc.3, =1.6.0, =0.1.1, =0.0.1, =0.1.0, =0.1.0, =1.0.1, =1.0.6 - @apsknight/jupyterlabxkcd =0.1.0 - @azidar/diagrammer-jupyterlab-ext =0.1.0 and more Source cves: CVE-2021-3377 Source advisory: OSV:GHSA-2V5F-23XC-V9QR...

CVE-2021-3377

A flaw was found in npm package ansiup versions 5.0.0 when parsing untrusted user input. An attacker could take advantage of this by introducing ANSI escape codes to inject arbitrary HTML and JavaScript in result mounting a cross-site scripting XSS attack...

CVE-2021-3377

The npm package ansiup converts ANSI escape codes into HTML. In ansiup v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting XSS vulnerability. This issue is fixed in v5.0.0...

CVE-2021-3377

The CVE-2021-3377 issue affects the npm package ansi_up (used to convert ANSI escape codes to HTML). In version 4, the feature allowing ANSI codes to create HTML hyperlinks was not properly sanitized, enabling cross-site scripting (XSS). The vulnerability is fixed in version 5.0.0 and later. Prac...

CVE-2021-3377

The npm package ansiup converts ANSI escape codes into HTML. In ansiup v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting XSS vulnerability. This issue is fixed in v5.0.0...

Cisco Data Center Network Manager Command Injection (cisco-sa-devmgr-cmd-inj-Umc8RHNh)

According to its self-reported version, Cisco Data Center Network Manager is affected by a command injection vulnerability due to insufficient validation of user-supplied input. A remote, authenticated attacker can exploit this vulnerability by sending crafted arguments to a specific field within...

RHEL 6 : chromium-browser (RHSA-2020:3377)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3377 advisory. Chromium is an open-source web browser, powered by WebKit Blink. This update upgrades Chromium to version 84.0.4147.105. Security Fixes:...

CVE-2020-3377

Cisco DCNM's Device Manager has a command-injection vulnerability due to insufficient input validation. An authenticated, remote attacker could trigger arbitrary commands with administrator privileges on the DCNM. The incident is documented across multiple sources (Cisco security advisory CISCO-S...

Ubuntu 17.04 : linux, linux-raspi2 vulnerabilities (USN-3377-1) (Stack Clash)

Fan Wu and Shixiong Zhao discovered a race condition between inotify events and vfs rename operations in the Linux kernel. An unprivileged local attacker could use this to cause a denial of service system crash or execute arbitrary code. CVE-2017-7533 It was discovered that the Linux kernel did n...

Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3377-2)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3377-2 advisory. USN-3377-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04. This update provides the corresponding updates for the Linux Hardware Enablement H...

CVE-2017-3377

Vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite subcomponent: User Interface. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with...