579 matches found
Command injection
Vulnerability in rand-quote and hitokoto plugins Description: the rand-quote and hitokoto fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use print -P to print them. If these quotes contained the proper symbols, they could trigger command...
CVE-2021-3727
Vulnerability in rand-quote and hitokoto plugins Description: the rand-quote and hitokoto fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use print -P to print them. If these quotes contained the proper symbols, they could trigger command...
CVE-2021-3727 OS Command Injection in ohmyzsh/ohmyzsh
Vulnerability in rand-quote and hitokoto plugins Description: the rand-quote and hitokoto fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use print -P to print them. If these quotes contained the proper symbols, they could trigger command...
CVE-2021-3727
CVE-2021-3727 concerns the ohmyzsh rand-quote and hitokoto plugins. The description states that quotes fetched from external APIs (quotationspage.com and hitokoto.cn) could, if containing certain symbols, trigger a command injection when processed and printed via print -P. The root cause is not d...
CVE-2021-3727: Improper Neutralization of Special Elements used in an OS Command
Vulnerability in rand-quote and hitokoto plugins Description: the rand-quote and hitokoto fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use print -P to print them. If these quotes contained the proper symbols, they could trigger command...
ohmyzsh 操作系统命令注入漏洞
ohmyzsh is an open source, community-driven framework for managing your zsh configuration. ohmyzsh suffers from an operating system command injection vulnerability that can be exploited by an attacker to trigger command injection via the rand-quote and hitokoto plugins...
PT-2021-21596
Name of the Vulnerable Software and Affected Versions ohmyzsh versions prior to the version that includes commit 72928432 Description The issue concerns command injection through quotes fetched from external APIs by the rand-quote and hitokoto plugins. These plugins process quotes from...
DEBIAN-CVE-2021-34146
The Bluetooth Classic implementation in the Cypress CYW920735Q60EVB does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and restart crash of the device by flooding it with LMPAURand packets after the pagi...
CVE-2021-34146
The Bluetooth Classic implementation in the Cypress CYW920735Q60EVB does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and restart crash of the device by flooding it with LMPAURand packets after the pagi...
CVE-2021-34149
The Bluetooth Classic implementation on the Texas Instruments CC256XCQFN-EM does not properly handle the reception of continuous LMPAURand packets, allowing attackers in radio range to trigger a denial of service deadlock of the device by flooding it with LMPAURand packets after the paging...
PT-2021-4298
Name of the Vulnerable Software and Affected Versions Texas Instruments CC256XCQFN-EM affected versions not specified Description The Bluetooth Classic implementation does not properly handle the reception of continuous LMP AU Rand packets, allowing attackers in radio range to trigger a denial of...
PT-2021-4360
Name of the Vulnerable Software and Affected Versions Cypress CYW920735Q60EVB affected versions not specified CC256xCQFN-EM affected versions not specified Description The Bluetooth Classic implementation does not properly handle the reception of continuous unsolicited LMP responses, allowing...
PT-2021-4302
Name of the Vulnerable Software and Affected Versions AB32VG1 devices affected versions not specified Description The Bluetooth Classic implementation does not properly handle the reception of continuous unsolicited LMP responses. This allows attackers in radio range to trigger a denial of servic...
PT-2021-4306
Name of the Vulnerable Software and Affected Versions Zhuhai Jieli AC6366C DEMO V1.0 Description The Bluetooth Classic implementation does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service deadlock of the...
CVE-2021-27913
The function mtrand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are not under...
CVE-2021-34430
Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it easier for remote attackers to compute the master key and then decrypt DTLS traffic...
CVE-2021-34430
Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it easier for remote attackers to compute the master key and then decrypt DTLS traffic...
Open redirect
Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it easier for remote attackers to compute the master key and then decrypt DTLS traffic...
CVE-2021-34430
Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it easier for remote attackers to compute the master key and then decrypt DTLS traffic...
CVE-2021-34430: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it easier for remote attackers to compute the master key and then decrypt DTLS traffic...