CVE-2024-21533

All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone API, which allows specifying the remote URL to clone and the file on disk to clone to. The library does not sanitize for user input or validate a given URL scheme, nor does it properly pass command-line...

CVE-2024-21533

GGIT is affected across all versions by Arbitrary Argument Injection via the clone() API. The root cause is failure to sanitize user input and validate URL schemes, plus improper handling of git command-line flags (using -- to end options). Public details include a PoC from Snyk and a GitHub gist...

CVE-2024-21533

All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone API, which allows specifying the remote URL to clone and the file on disk to clone to. The library does not sanitize for user input or validate a given URL scheme, nor does it properly pass command-line...

Siemens SINEC Security Monitor

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

CVE-2024-9569

A vulnerability has been found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this vulnerability is the function formEasySetPassword of the file /goform/formEasySetPassword. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely...

CVE-2023-6362

A vulnerability has been discovered in Winhex affecting version 16.1 SR-1 and 20.4. This vulnerability consists of a buffer overflow controlling the Structured Exception Handler SEH registers. This could allow attackers to execute arbitrary code via a long filename argument...

CVE-2023-6361

A vulnerability has been discovered in Winhex affecting version 16.1 SR-1 and 20.4. This vulnerability consists of a buffer overflow controlling the Structured Exception Handler SEH registers. This could allow attackers to execute arbitrary code via a long filename argument...

CVE-2023-6361

A vulnerability has been discovered in Winhex affecting version 16.1 SR-1 and 20.4. This vulnerability consists of a buffer overflow controlling the Structured Exception Handler SEH registers. This could allow attackers to execute arbitrary code via a long filename argument...

PT-2024-18947 · Ggit · Ggit

Name of the Vulnerable Software and Affected Versions: ggit versions all Description: The issue concerns Arbitrary Argument Injection via the clone API. This API allows specifying the remote URL to clone and the file on disk to clone to. However, the library fails to sanitize user input or valida...

PT-2024-7099 · D Link · D-Link Dir-605L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-605L version 2.13B01 BETA Description: A critical issue was found in the function formWlanWizardSetup of the file /goform/formWlanWizardSetup. The manipulation of the argument webpage leads to buffer overflow. It is possible to...

PT-2024-39682 · Unknown · Esafenet Cdg

Name of the Vulnerable Software and Affected Versions: ESAFENET CDG V5 Description: A critical issue affects an unknown functionality of the file /MultiServerBackService?path=1. The manipulation of the fileId argument leads to SQL injection. The attack may be launched remotely. The exploit has be...

CVE-2024-46078

itsourcecode Sports Management System Project 1.0 is vulnerable to SQL Injection in the function deletecategory of the file sportsscheduling/player.php via the argument id...

CVE-2024-9375

The WordPress Captcha Plugin by Captcha Bank plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 4.0.36. This makes it possible for unauthenticated attackers to inject...

CVE-2024-9384

The Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attacker...

CVE-2024-46078

itsourcecode Sports Management System Project 1.0 is vulnerable to SQL Injection in the function deletecategory of the file sportsscheduling/player.php via the argument id...

CVE-2024-46078

itsourcecode Sports Management System Project 1.0 is vulnerable to SQL Injection in the function deletecategory of the file sportsscheduling/player.php via the argument id...

Advisory ROSA-SA-2024-2487

Software: flatpak 1.0.9 OS: rosa-server79 packageevrstring: flatpak-1.0.9-13.res7 CVE-ID: CVE-2021-41133 BDU-ID: 2022-00259 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Flatpak application and environment management tool is related to a lack of blocking in the seccomp filter of mount-related...

SUSE CVE-2024-47611

XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows MinGW-w64 or MSVC, the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerability. If a command line contains Unicode characters for exampl...

Improper Handling of Unicode Encoding

Overview Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding via the command line argument processing. An attacker can manipulate command line inputs to inject unintended arguments or traverse directories by providing malicious filenames containing Unicode...

CVE-2024-47611 XZ Utils on Microsoft Windows platform are vulnerable to argument injection

XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows MinGW-w64 or MSVC, the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerability. If a command line contains Unicode characters for exampl...