665 matches found
less: OS command injection
An OS command injection flaw was found in Less. Since quoting is mishandled in filename.c, opening files with attacker-controlled file names can lead to OS command execution. Exploitation requires the LESSOPEN environment variable, which is set by default in many common cases...
Security Bulletin: Multiple vulnerabilities in eclipse jetty affect IBM Business Automation Workflow
Summary IBM Business Automation Workflow packages a vulnerable version of the eclipse jetty library. Vulnerability Details CVEID:CVE-2020-27216 DESCRIPTION: Eclipse Jetty could allow a local authenticated attacker to gain elevated privileges on the system, caused by a race condition in the creati...
less: OS command injection
An OS command injection flaw was found in Less. Since quoting is mishandled in filename.c, opening files with attacker-controlled file names can lead to OS command execution. Exploitation requires the LESSOPEN environment variable, which is set by default in many common cases...
Important: less
Issue Overview: less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation als...
CLSA-2024-1716272273 less: Fix of CVE-2022-48624
CVE-2022-48624: filename.c: shell-quote filenames when invoking LESSCLOSE...
CLSA-2024-1716272169 less: Fix of CVE-2022-48624
CVE-2022-48624: filename.c: shell-quote filenames when invoking LESSCLOSE...
CLSA-2024-1716271951 less: Fix of CVE-2022-48624
CVE-2022-48624: shell-quote filenames when invoking LESSCLOSE...
CLSA-2024-1715947224 Fix CVE(s): CVE-2024-32487
SECURITY UPDATE: quoting is mishandled in filename.c. - debian/patches/CVE-2024-32487.patch: Fix bug when viewing a file whose name contains a newline. - CVE-2024-32487...
CLSA-2024-1715946971 less: Fix of CVE-2024-32487
CVE-2024-32487: filename.c: quoting mishandling...
less: Fix of CVE-2024-32487
CVE-2024-32487: filename.c: quoting mishandling...
CLSA-2024-1715946466 less: Fix of CVE-2024-32487
CVE-2024-32487: filename.c: quoting mishandling...
OESA-2024-1587 less security update
Less is a pager. A pager is a program that displays text files. Other pagers commonly in use are more and pg. Pagers are often used in command-line environments like the Unix shell and the MS-DOS command prompt to display files. Security Fixes: less through 653 allows OS command execution via a...
Mass Assignment
Laravel is vulnerable to Mass Assignment. The vulnerability is due to insufficient column quoting for all database drivers, which could allow attackers to perform unauthorized mass assignment operations. If using guarded and passing a user-controlled array into an "update" or "save" function,...
Laravel Risk of mass-assignment vulnerabilities
Laravel 4.1.29 improves the column quoting for all database drivers. This protects your application from some mass assignment vulnerabilities when not using the fillable property on models. If you are using the fillable property on your models to protect against mass assignment, your application ...
Doctrine DBAL SQL injection possibility
The identifier quoting in Doctrine DBAL has a potential security problem when user-input is passed into this function, making the security aspect of this functionality obsolete. If you make use of AbstractPlatform::quoteIdentifier or Doctrine::quoteIdentifier please upgrade immediately. The ORM...
CLSA-2024-1715673753 Fix CVE(s): CVE-2024-32487
SECURITY UPDATE: quoting is mishandled in filename.c. - debian/patches/CVE-2024-32487.patch: Fix bug when viewing a file whose name contains a newline. - CVE-2024-32487...
CLSA-2024-1715673596 less: Fix of CVE-2024-32487
Fix CVE-2024-32487: filename.c: quoting mishandling...
CLSA-2024-1715673429 less: Fix of CVE-2024-32487
Fix CVE-2024-32487: filename.c: quoting mishandling...