PT-2023-36038 · Icu · Icu

Name of the Vulnerable Software and Affected Versions: icu 74 affected versions not specified Description: The issue is related to a crash in the icu 74 library, specifically in the UnicodeString class. The crash occurs when the copyFrom function is called, leading to a segmentation fault on an...

Cross site scripting

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcubestringreplacer.php behavior...

Fedora: Security Advisory for golang-github-xhit-str2duration (FEDORA-2023-1b25579262)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 38 Update: golang-github-xhit-str2duration-2.1.0-3.fc38

Convert string to duration in golang...

[SECURITY] Fedora 37 Update: golang-github-xhit-str2duration-2.1.0-3.fc37

Convert string to duration in golang...

PT-2023-6508

Name of the Vulnerable Software and Affected Versions Eclipse RAP versions 3.0.0 through 3.25.0 Description The issue is related to a not completely secure extraction of the file name in the FileUploadProcessor.stripFileNameString name method. This allows for Remote Code Execution on Windows when...

Advanced Open VPN Function Wi-Fi Router ASUS RT-AX88U Privilege Escalation

The vulnerability of the Advanced Open VPN function in the microprogramming software for Wi-Fi routers from ASUS, the RT-AX88U, is related to the use of uncontrolled format strings. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected...

CVE-2023-43204

D-LINK DWL-6610 FWv4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub2EF50. This vulnerability allows attackers to execute arbitrary commands via the manual-time-string parameter...

CVE-2023-43204

D-LINK DWL-6610 FWv4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub2EF50. This vulnerability allows attackers to execute arbitrary commands via the manual-time-string parameter...

CVE-2023-43204

D-LINK DWL-6610 FWv4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub2EF50. This vulnerability allows attackers to execute arbitrary commands via the manual-time-string parameter...

Command injection

D-LINK DWL-6610 FWv4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub2EF50. This vulnerability allows attackers to execute arbitrary commands via the manual-time-string parameter...

[SECURITY] Fedora 39 Update: golang-github-xhit-str2duration-2.1.0-3.fc39

Convert string to duration in golang...

D-LINK DWL-6610 Command Injection Vulnerability

The D-Link DWL-6610 is a wireless access point from China-based D-Link. A security vulnerability exists in the D-LINK DWL-6610, which originates from a command injection vulnerability in the function sub2EF50. The vulnerability can be exploited to execute arbitrary commands via the...

CVE-2023-36109

Buffer Overflow vulnerability in JerryScript version 3.0, allows remote attackers to execute arbitrary code via ecmastringbuilderappendraw component at /jerry-core/ecma/base/ecma-helpers-string.c...

CVE-2023-43204: Improper Neutralization of Special Elements used in a Command

D-LINK DWL-6610 FWv4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub2EF50. This vulnerability allows attackers to execute arbitrary commands via the manual-time-string parameter...

CVE-2023-43204

D-LINK DWL-6610 FWv4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub2EF50. This vulnerability allows attackers to execute arbitrary commands via the manual-time-string parameter...

CVE-2023-43204

D-LINK DWL-6610 FWv4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub2EF50. This vulnerability allows attackers to execute arbitrary commands via the manual-time-string parameter...

phonenumber: panic on parsing crafted RF3966 phonenumber inputs

Impact The phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string .;phone-context=. Patches...

PT-2023-27025 · Unknown · Isl Arp Guard

Name of the Vulnerable Software and Affected Versions: ISL ARP Guard version 4.0.2 Description: A reflected cross-site scripting XSS issue exists in the url str URL parameter, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload. This enables the execution of maliciou...

Design/Logic Flaw

SQLpage is a SQL-only webapp builder. Someone using SQLpage versions prior to 0.11.1, whose SQLpage instance is exposed publicly, with a database connection string specified in the sqlpage/sqlpage.json configuration file not in an environment variable, with the webroot is the current working...