Splunk 注入漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. It is used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. Splunk has an injection vulnerability that stems...

PT-2023-29657 · Splunk · Splunk It Service Intelligence

Name of the Vulnerable Software and Affected Versions: Splunk IT Service Intelligence ITSI versions prior to 4.13.3 Splunk IT Service Intelligence ITSI versions prior to 4.15.3 Splunk IT Service Intelligence ITSI versions prior to 4.17.1 Description: A malicious actor can inject American National...

CLSA-2023-1692110840 Fix CVE(s): CVE-2018-7409

SECURITY UPDATE: Fix buffer overflow - debian/patch/CVE-2018-7409: fix unicodetoansicopy, don't include NUL-terminator in length in unicodetoansialloc, make sure that the error handling doesn't overrun the buffer - CVE-2018-7409...

CVE-2023-39342

CVE-2023-39342 affects Dangerzone CLI (dangerzone-cli) prior to 0.4.2. The issue arises because the CLI logs container-output from the sanitization process to the user’s terminal and also logs file names; if the container is compromised, an attacker could return attacker-controlled strings to spo...

CVE-2023-39342 Dangerzone CLI does not sanitize ANSI escape characters

Dangerzone is software for converting potentially dangerous PDFs, office documents, or images to safe PDFs. The Dangerzone CLI dangerzone-cli command logs output from the container where the file sanitization takes place, to the user's terminal. Prior to version 0.4.2, if the container is...

CVE-2023-39342 Dangerzone CLI does not sanitize ANSI escape characters

Dangerzone is software for converting potentially dangerous PDFs, office documents, or images to safe PDFs. The Dangerzone CLI dangerzone-cli command logs output from the container where the file sanitization takes place, to the user's terminal. Prior to version 0.4.2, if the container is...

CVE-2023-39342 Dangerzone CLI does not sanitize ANSI escape characters

Dangerzone is software for converting potentially dangerous PDFs, office documents, or images to safe PDFs. The Dangerzone CLI dangerzone-cli command logs output from the container where the file sanitization takes place, to the user's terminal. Prior to version 0.4.2, if the container is...

PT-2023-26889 · Unknown · Dangerzone

Name of the Vulnerable Software and Affected Versions: Dangerzone versions prior to 0.4.2 Description: The issue affects the Dangerzone CLI, where output from the container is logged to the user's terminal. If the container is compromised, an attacker may spoof messages in the terminal or change...

Vulnerability fixed in Splunk SOAR

Splunk has fixed a vulnerability in Splunk SOAR. The vulnerability allows an unauthenticated malicious person to inject inject ANSI escape code into a log file. To do so, the malicious party must send a specially prepared HTTP request to the Spunk SOAR instance. When this log file is read in a...

CVE-2023-3997

Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to vi...

CVE-2023-3997

Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to vi...

Design/Logic Flaw

Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to vi...

CVE-2023-3997 Unauthenticated Log Injection In Splunk SOAR

Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to vi...

[SECURITY] Fedora 37 Update: yajl-2.1.0-21.fc37

Yet Another JSON Library. YAJL is a small event-driven SAX-style JSON parser written in ANSI C, and a small validating JSON generator...

Improper Validation

agpt is vulnerable to Improper Validation. The vulnerability exists due to a lack of validated ANSI escape sequences in logs.py, which allow an attacker to publish false messages to the terminal by tricking the LLM into reciting JSON-encoded ANSI escape sequences...

[SECURITY] Fedora 38 Update: yajl-2.1.0-21.fc38

Yet Another JSON Library. YAJL is a small event-driven SAX-style JSON parser written in ANSI C, and a small validating JSON generator...

CVE-2023-37275

Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. The Auto-GPT command line UI makes heavy use of color-coded print statements to signify different types of system messages to the user, including messages that are crucial for the user to...

Command injection

Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. The Auto-GPT command line UI makes heavy use of color-coded print statements to signify different types of system messages to the user, including messages that are crucial for the user to...

CVE-2023-37275

CVE-2023-37275 affects Auto-GPT prior to v0.4.3, where a malicious external resource could cause the LLM to regurgitate JSON-encoded ANSI escape sequences, which are decoded and printed to the console as part of the model’s thinking process, spoofing system logs. The vulnerability is fixed in rel...

CVE-2023-37275 System logs spoofable in Auto-GPT via ANSI control sequences

Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. The Auto-GPT command line UI makes heavy use of color-coded print statements to signify different types of system messages to the user, including messages that are crucial for the user to...