CVE-2023-28487: Improper Encoding or Escaping of Output

Sudo before 1.9.13 does not escape control characters in sudoreplay output...

PT-2023-9223

Name of the Vulnerable Software and Affected Versions Flatpak versions prior to 1.10.8 Flatpak versions prior to 1.12.8 Flatpak versions prior to 1.14.4 Flatpak versions prior to 1.15.4 Description The issue is related to the Flatpak system for building, distributing, and running sandboxed deskto...

CVE-2023-28487

Sudo before 1.9.13 does not escape control characters in sudoreplay output...

CVE-2023-28486

Sudo before 1.9.13 does not escape control characters in log messages...

Sudo 安全漏洞

Sudo is a program used on Unix-like systems that allows users to execute commands in a secure manner with special privileges. A security vulnerability exists in versions of Sudo prior to 1.9.13 that stems from the fact that Sudo does not escape control characters in log messages...

PT-2023-2285

Name of the Vulnerable Software and Affected Versions Deno versions prior to 1.31.2 Description The issue is related to the lack of filtering for special control characters in Deno, a runtime for JavaScript and TypeScript. This allows a malicious program to clear the first two lines of a prompt a...

SUSE-SU-2023:0707-1 Security update for python39

This update for python39 fixes the following issues: - CVE-2023-24329: Fixed blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters bsc1208471. Update to 3.9.16: - python -m http.server no longer allows terminal control characters sent within a...

Debian: Security Advisory (DLA-473-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Denial Of Service (DoS)

lite-web-server is vulnerable to Denial Of Service DoS. The vulnerability exists due to the decodeURIComponent function which is unable to parse control characters, allowing an attacker to cause an application crash...

GHSA-8237-3Q5G-99FV Denial of Service vulnerability in lite-web-server

All versions of the package lite-web-server are vulnerable to Denial of Service DoS when an attacker sends an HTTP request and includes control characters that the decodeURI function is unable to parse...

CVE-2023-26104

All versions of the package lite-web-server are vulnerable to Denial of Service DoS when an attacker sends an HTTP request and includes control characters that the decodeURI function is unable to parse...

CVE-2023-26104

All versions of the package lite-web-server are vulnerable to Denial of Service DoS when an attacker sends an HTTP request and includes control characters that the decodeURI function is unable to parse...

CVE-2023-26104

All versions of the package lite-web-server are vulnerable to Denial of Service DoS when an attacker sends an HTTP request and includes control characters that the decodeURI function is unable to parse...

CVE-2023-26104

The CVE-2023-26104 entry concerns lite-web-server. Affected: lite-web-server library; Root cause: DoS triggered when an HTTP request includes control characters that decodeURI() cannot parse, leading to an availability impact (DoS). Exploitation details are documented in Snyk (PoC) and GitHub ref...

CVE-2023-26104: Uncontrolled Resource Consumption

All versions of the package lite-web-server are vulnerable to Denial of Service DoS when an attacker sends an HTTP request and includes control characters that the decodeURI function is unable to parse...

PT-2023-20491

Name of the Vulnerable Software and Affected Versions lite-web-server affected versions not specified Description The issue concerns a Denial of Service DoS condition that occurs when an attacker sends an HTTP request containing control characters that the decodeURI function cannot parse. This ca...

SUSE CVE-2008-5508

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly parse URLs with leading whitespace or control characters, which might allow remote attackers to misrepresent URLs and simplify phishing attacks...

SUSE CVE-2014-3146

Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting XSS attacks via control characters in the link scheme to the cleanhtml function...

USN-5848-1 less vulnerability

David Leadbeater discovered that less was not properly handling escape sequences when displaying raw control characters. A maliciously formed OSC 8 hyperlink could possibly be used by an attacker to cause a denial of service...

PT-2023-3591

Name of the Vulnerable Software and Affected Versions Sudo versions prior to 1.9.13 Description The issue is related to a lack of proper encoding or escaping of output in the Sudo program, which can be exploited by a remote attacker to gain access to confidential data. The problem specifically...