Mozilla: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content

The Mozilla Foundation Security Advisory describes this flaw as: If a Thunderbird user quoted from an HTML email and the email contained either a video tag with the poster attribute or an object tag with a data attribute, a network request to the referenced remote URL was performed regardless of ...

Security Vulnerabilities fixed in Thunderbird 102.5.1 — Mozilla

If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block...

CVE-2022-31092: Improper Neutralization of Special Elements used in an SQL Command

Pimcore is an Open Source Data & Experience Management Platform. Pimcore offers developers listing classes to make querying data easier. This listing classes also allow to order or group the results based on one or more columns which should be quoted by default. The actual issue is that quoting i...

Diffy 安全漏洞

Diffy is a simple distinction in Ruby by Sam Goldstein, a personal developer. Diffy suffers from a security vulnerability that stems from the fact that the function that calls the diff utility in Diffy 3.4.1 does not properly handle double quotes in filenames when running in a Windows environment...

GHSA-3FJ4-Q72X-X2G9 ADOdb Library SQL Injection

The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting...

ADOdb Library SQL Injection

The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting...

CVE-2022-29583

servicewindows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executable from the intended directory. NOTE: this finding could not be reproduced by its original reporter or by others...

CVE-2022-29583

servicewindows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executable from the intended directory. NOTE: this finding could not be reproduced by its original reporter or by others...

PT-2022-19706 · Unknown · Kardianos Service Package

Name of the Vulnerable Software and Affected Versions: kardianos service package for Go affected versions not specified Description: The issue is related to the service windows.go file in the kardianos service package for Go, which omits quoting that is sometimes needed for the execution of a...

CVE-2022-29583

servicewindows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executable from the intended directory. NOTE: this finding could not be reproduced by its original reporter or by others...

Rapid7 Insight Agent 代码问题漏洞

Rapid7 Insight Agent is a lightweight software from Rapid7, Inc. The software is capable of collecting data from IT assets.A security vulnerability exists in Rapid7 Insight Agent version 3.1.2.38 and prior versions, which stems from the fact that Rapid7 Insight Agent version 3.1.2.38 and prior...

shell-quote 命令注入漏洞

shell-quote is an open source package. It is used to parse and quote shell commands. A security vulnerability exists in the shell-quote package, which can be exploited by attackers to insert arbitrary code to perform related operations...

grub2: Heap out-of-bounds write due to miscalculation of space required for quoting

A flaw was found in grub2. Setparamprefix in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in th...

grub2: Heap out-of-bounds write due to miscalculation of space required for quoting

A flaw was found in grub2. Setparamprefix in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in th...

The vulnerability of the sub-component Courseware within the Oracle Quoting component of the Oracle E-Business Suite allows a perpetrator to gain unauthorized access to the device.

The vulnerability of the Courseware sub-component of the Oracle Quoting component in the Oracle E-Business Suite system’s enterprise automation activity system is related to code errors. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to the...

CVE-2021-2268

Vulnerability in the Oracle Quoting product of Oracle E-Business Suite component: Courseware. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quoting. Successful attacks of th...

CVE-2021-2268

Vulnerability in the Oracle Quoting product of Oracle E-Business Suite component: Courseware. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quoting. Successful attacks of th...

CVE-2021-2268

Vulnerability in the Oracle Quoting product of Oracle E-Business Suite component: Courseware. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quoting. Successful attacks of th...

CVE-2021-2268

Vulnerability in the Oracle Quoting product of Oracle E-Business Suite component: Courseware. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quoting. Successful attacks of th...

CVE-2021-2268

CVE-2021-2268 affects Oracle E-Business Suite, Oracle Quoting Courseware (versions 12.1.1–12.1.3). The vulnerability allows a low-privilege, network-accessible attacker over HTTP to compromise Oracle Quoting, potentially leading to unauthorized creation, deletion, or modification of data or acces...