SUSE CVE-2021-40656

libsixel before 1.10 is vulnerable to Buffer Overflow in libsixel/src/quant.c:867...

SUSE CVE-2021-41136

Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using puma with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a...

SUSE CVE-2021-45942

OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf31::LineCompositeTask::execute called from IlmThread31::NullThreadPoolProvider::addTask and IlmThread31::ThreadPool::addGlobalTask. NOTE: db217f2 may be inapplicable...

SUSE CVE-2022-26661

An XXE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform Command Line Client proteus 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user...

SUSE CVE-2022-27044

libsixel 1.8.6 is affected by Buffer Overflow in libsixel/src/quant.c:876...

SUSE CVE-2022-28506

There is a heap-buffer-overflow in GIFLIB 5.2.1 function DumpScreen2RGB in gif2rgb.c:298:45...

SUSE CVE-2022-31212

An issue was discovered in dbus-broker before 31. It depends on c-uitl/c-shquote to parse the DBus service's Exec line. c-shquote contains a stack-based buffer over-read if a malicious Exec line is supplied...

SUSE CVE-2022-34903

GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints e.g., use of GPGME are met, allows signature forgery via injection into the status line...

SUSE CVE-2022-37048

The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in getl2lenprotocol at common/get.c:344. NOTE: this is different from CVE-2022-27941...

SUSE CVE-2022-38928

XPDF 4.04 is vulnerable to Null Pointer Dereference in FoFiType1C.cc:2393...

SUSE CVE-2022-39334

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or...

The vulnerability of the Crestron AirMedia collaborative presentation system lies in improper privilege handling, allowing an intruder to gain access to the command line with the SYSTEM privilege level.

The vulnerability of the Crestron AirMedia collaborative presentation system is related to incorrect privilege handling. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to the command line with SYSTEM privileges...

The vulnerability of the command-line interface of the network traffic analysis and detection tool, Cortex XDR Agent, for operating systems based on Windows, allows a perpetrator to execute arbitrary commands.

The vulnerability of the command-line interface of the network traffic analysis, network detection, and response tool Cortex XDR Agent for Windows operating systems is related to a breach of the data protection mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary...

CVE-2023-23914

A cleartext transmission of sensitive information vulnerability exists in curl v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is...

PT-2023-6472 · Cisco · Cisco Secure Email/Web Manager +1

Name of the Vulnerable Software and Affected Versions: Cisco Secure Email Gateway ESA and Cisco Secure Email and Web Manager SMA affected versions not specified Description: A vulnerability in the Web UI and administrative CLI of the affected systems could allow an authenticated remote or local...

The vulnerability of the command-line interface of the network traffic analysis, network detection, and response tool Cortex XDR Agent for Windows operating systems allows a malicious actor to gain unauthorized access to protected information and execute arbitrary commands.

The vulnerability of the command-line interface of the network traffic analysis, network detection, and response tool Cortex XDR Agent for Windows operating systems is related to the storage of data in an open manner. Exploiting this vulnerability can allow attackers to gain unauthorized access t...

CVE-2022-31808

A vulnerability has been identified in SiPass integrated AC5102 ACC-G2 All versions V2.85.44, SiPass integrated ACC-AP All versions V2.85.43. Affected devices improperly sanitize user input on the telnet command line interface. This could allow an authenticated user to escalate privileges by...

The vulnerability of the Zoom Rooms video conferencing service for macOS exists due to the lack of measures taken to neutralize special elements used in the operating system’s command line. This allows a malicious user to elevate their privileges to root level.

The vulnerability of the Zoom Rooms video conferencing service for macOS exists because measures to neutralize special elements used in the operating system are not taken. Exploiting this vulnerability can allow a hacker to elevate their privileges to the root level...

Design/Logic Flaw

The public API function BIOnewNDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the...

CVE-2023-0215

CVE-2023-0215 describes a use-after-free in OpenSSL’s BIO_new_NDEF path used with SMIME/CMS/PKCS7 streaming. When a CMS recipient key is invalid, the filter BIO is freed but the caller’s BIO still holds pointers, allowing use-after-free on BIO_pop(); this can crash the process. Affected internal ...