Command injection

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or...

CVE-2023-51385

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or...

OPENSUSE-SU-2023:0405-1 Security update for fish

This update for fish fixes the following issues: - CVE-2023-49284: Fixed shell expansion triggered by command substitution output boo1217808...

OPENSUSE-SU-2023:0404-1 Security update for fish

This update for fish fixes the following issues: - CVE-2023-49284: Fixed shell expansion triggered by command substitution output boo1217808...

Security update for fish (moderate)

openSUSE Security Update: Security update for fish Announcement ID: openSUSE-SU-2023:0405-1 Rating: moderate References: 1217808 Cross-References: CVE-2023-49284 CVSS scores: CVE-2023-49284 NVD : 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H CVE-2023-49284 SUSE: 4.4...

Command substitution output can trigger shell expansion in fish shell

...

SUSE CVE-2023-49284

fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will incorrectly allow these markers to be read on command substitution output, rather than...

OESA-2023-1881 qt security update

Qt pronounced as "cute", not "cu-tee" is a cross-platform framework that is usually used as a graphical toolkit, although it is also very helpful in creating CLI applications. It runs on the three major desktop OSes, as well as on mobile OSes, such as Symbian, Nokia Belle, Meego Harmattan, MeeGo ...

OESA-2023-1878 qt security update

Qt pronounced as "cute", not "cu-tee" is a cross-platform framework that is usually used as a graphical toolkit, although it is also very helpful in creating CLI applications. It runs on the three major desktop OSes, as well as on mobile OSes, such as Symbian, Nokia Belle, Meego Harmattan, MeeGo ...

OESA-2023-1877 qt security update

Qt pronounced as "cute", not "cu-tee" is a cross-platform framework that is usually used as a graphical toolkit, although it is also very helpful in creating CLI applications. It runs on the three major desktop OSes, as well as on mobile OSes, such as Symbian, Nokia Belle, Meego Harmattan, MeeGo ...

Security Bulletin: Multiple security vulnerabilities in Snake YAML affect IBM Sterling B2B Integrator

Summary IBM Sterling B2B Integrator uses Snake YAML. Vulnerability Details CVEID: CVE-2017-18640 DESCRIPTION: SnakeYAML is vulnerable to a denial of service, caused by an entity expansion in Alias feature during a load operation. By sending a specially crafted request, a remote attacker could...

Oracle Linux 8 : qt5-qtbase (ELSA-2023-6967)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6967 advisory. - Fix infinite loops in QXmlStreamReader CVE-2023-38197 Resolves: bz2222770 - Don't allow remote attacker to bypass security restrictions caused by fla...

WordPress VK All in One Expansion Unit Plugin < 9.86.0.0 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:vektor-inc:vkallinoneexpansionunit"; if description...

Oracle Linux 9 : qt5 (ELSA-2023-6369)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6369 advisory. - Fix infinite loops in QXmlStreamReader CVE-2023-38197 Resolves: bz2222771 - Don't allow remote attacker to bypass security restrictions caused by fla...

Microsoft unveils expansion of AI for security and security for AI at Microsoft Ignite

The future of security with AI The increasing speed, scale, and sophistication of recent cyberattacks demand a new approach to security. Traditional tools are no longer enough to keep pace with the threats posed by cybercriminals. In just two years, the number of password attacks detected by...

CentOS 8 : qt5-qtbase (CESA-2023:6967)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:6967 advisory. - An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. QDnsLookup has a buffer over-read via a...

PT-2023-30338 · Remarshal · Remarshal

Name of the Vulnerable Software and Affected Versions: Remarshal versions prior to 0.17.1 Description: The issue allows for the expansion of YAML alias nodes unlimitedly, making Remarshal susceptible to a Billion Laughs Attack. This can lead to a denial-of-service DoS condition when processing...

JVN#86156389: Remarshal unlimitedly expanding YAML alias nodes

Remarshal provided by Remarshal Project expands YAML alias nodes unlimitedly CWE-674, hence Remarshal is vulnerable to Billion Laughs Attack. Impact Processing untrusted YAML files may cause a denial-of-service DoS condition. Solution Update the Software Update to the latest version according to...

Imperva Expands Global Network, Adds First PoP in Vietnam

We are delighted to announce our first Point of Presence PoP in Hanoi, Vietnam, expanding our global network with our 16th PoP located in the Asia Pacific & Japan APJ region. Alongside its rich culture and historic sites, Hanoi, the enchanting capital city of Vietnam, is a bustling business cente...

Rocky Linux 8 : prometheus-jmx-exporter (RLSA-2020:4807)

The remote Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2020:4807 advisory. - The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564. CVE-2017-18640 Note that Nessus h...