SketchSVG Arbitrary Code Injection vulnerability

All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current directory as part of the command string...

PT-2023-20494 · Sketchsvg · Sketchsvg

Name of the Vulnerable Software and Affected Versions: sketchsvg versions all Description: The issue is related to Arbitrary Code Injection when invoking shell.exec without proper sanitization or parametrization, specifically while concatenating the current directory as part of the command string...

PT-2023-2030 · NetGear · Netgear Nighthawk Wifi6 Router

Name of the Vulnerable Software and Affected Versions: NETGEAR Nighthawk WiFi6 Router versions prior to V1.0.10.94 Description: The issue is related to a format string vulnerability in a SOAP service of the NETGEAR Nighthawk WiFi6 Router. This vulnerability could allow an attacker to execute...

CVE-2015-10088

A vulnerability, which was classified as critical, was found in ayttm up to 0.5.0.89. This affects the function httpconnect in the library libproxy/proxy.c. The manipulation leads to format string. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The...

UBUNTU-CVE-2015-10088

A vulnerability, which was classified as critical, was found in ayttm up to 0.5.0.89. This affects the function httpconnect in the library libproxy/proxy.c. The manipulation leads to format string. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The...

Format string

A vulnerability, which was classified as critical, was found in ayttm up to 0.5.0.89. This affects the function httpconnect in the library libproxy/proxy.c. The manipulation leads to format string. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The...

CVE-2015-10088

A vulnerability, which was classified as critical, was found in ayttm up to 0.5.0.89. This affects the function httpconnect in the library libproxy/proxy.c. The manipulation leads to format string. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The...

CVE-2015-10088 ayttm proxy.c http_connect format string

A vulnerability, which was classified as critical, was found in ayttm up to 0.5.0.89. This affects the function httpconnect in the library libproxy/proxy.c. The manipulation leads to format string. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The...

CVE-2015-10088

CVE-2015-10088 affects ayttm up to 0.5.0.89, specifically the http_connect function in libproxy/proxy.c, where a format string vulnerability exists. The issue can be executed remotely and is described as high severity with complex exploitability. A patch is available (hash: 40e04680018614a7d2b685...

CVE-2015-10088

A vulnerability, which was classified as critical, was found in ayttm up to 0.5.0.89. This affects the function httpconnect in the library libproxy/proxy.c. The manipulation leads to format string. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The...

CVE-2015-10088: Use of Externally-Controlled Format String

A vulnerability, which was classified as critical, was found in ayttm up to 0.5.0.89. This affects the function httpconnect in the library libproxy/proxy.c. The manipulation leads to format string. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The...

openSUSE 15 Security Update : pkgconf (SUSE-SU-2023:0611-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:0611-1 advisory. - CVE-2023-24056: Fixed unbounded string expansion due to incorrect checks in libpkgconf/tuple.c bsc1207394. Tenable has extracted the preceding description...

AYTTM: Format string error vulnerability

ayttm is a general-purpose instant messenger. A format string error vulnerability exists in ayttm 0.5.0.89 and prior versions, which stems from the presence of a format string vulnerability...

PT-2023-10267 · Ayttm · Ayttm

Name of the Vulnerable Software and Affected Versions: ayttm versions up to 0.5.0.89 Description: A critical vulnerability was found in ayttm, affecting the function http connect in the library libproxy/proxy.c. The manipulation leads to a format string issue, which can be initiated remotely. The...

DEBIAN-CVE-2022-41862

In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes...

SUSE-SU-2023:0611-1 Security update for pkgconf

This update for pkgconf fixes the following issues: - CVE-2023-24056: Fixed unbounded string expansion due to incorrect checks in libpkgconf/tuple.c bsc1207394...

CVE-2022-41862

CVE-2022-41862 affects PostgreSQL libpq/client memory disclosure when connecting with Kerberos to a modified server. Connected documents confirm impact across multiple package tracks (libpq for AL2/Linux distros and PostgreSQL server/client suites for various versions, including 12.x–15.x), with ...

MGASA-2023-0077 Updated pkgconf packages fix security vulnerability

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconftupleparse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes. CVE-2023-24056...

Updated pkgconf packages fix security vulnerability

In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconftupleparse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes. CVE-2023-24056...

DEBIAN-CVE-2022-36021

Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands like SCAN or KEYS with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18...