GHSA-PR76-5CM5-W9CJ GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

GitPython before 3.1.32 does not block insecure non-multi options in clone and clonefrom, making it vulnerable to Remote Code Execution RCE due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerabili...

PT-2023-23664 · Avaya · Avaya Ix Workforce Engagement

Name of the Vulnerable Software and Affected Versions: Avaya IX Workforce Engagement version 15.2.7.1195 Description: The issue is related to URL redirection to untrusted sites, also known as an 'Open Redirect'. This occurs when a web application redirects a user to a URL without properly...

Design/Logic Flaw

giturlparse aka git-url-parse through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS Regular Expression Denial of Service if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package for example, to check whether it accesses any Git...

CVE-2023-32758

giturlparse aka git-url-parse through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS Regular Expression Denial of Service if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package for example, to check whether it accesses any Git...

CVE-2023-32758

giturlparse aka git-url-parse through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS Regular Expression Denial of Service if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package for example, to check whether it accesses any Git...

GHSA-28HP-FGCR-2R4H Cross-Site Scripting via JSONP

JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors...

Security hole in kicq

Hi all, there is some security related problem with kicq. The authors were contacted and provided with a suggestion for a patch which should be available soon. I did not find anything on the archive on this, so here we go. kicq is a free icq client clone available at http://kicq.sourceforge.net/...