Fedora 32 : glibc (2021-6e581c051a)

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-6e581c051a advisory. - The iconv program in the GNU C Library aka glibc or libc6 2.31 and earlier, when invoked with multiple suffixes in the destination encoding...

Nextcloud: [nextcloud.com] Control character allowed in Submit Question

Issue descriptions We found that the maximum length of the first and last name fields was not set to 32 characters at registration and to 1000 characters when using the profile update form. The attacker can use this method as a malware attack, the user will redirect to a website that contains...

Adobe Character Animator Installed

Binary data adobecharacteranimatorwininstalled.nbin...

Adobe Character Animator 3.0 < 3.3 Arbitrary code execution (APSB20-25)

The version of Adobe Character Animator installed on the remote Windows host is prior to 3.3. It is, therefore, affected by a vulnerability as referenced in the APSB20-25 advisory. - Adobe Character Animator versions 3.2 and earlier have a buffer overflow vulnerability. Successful exploitation...

Cisco Webex Teams Shared File Manipulation Vulnerability

Cisco Webex Teams is a comprehensive communications application designed to provide you with all the necessary tools and the right environment to enhance team collaboration. A shared file manipulation vulnerability exists in versions prior to Cisco Webex Teams 40.12.0.17293. The vulnerability ste...

CVE-2021-1242

A vulnerability in Cisco Webex Teams could allow an unauthenticated, remote attacker to manipulate file names within the messaging interface. The vulnerability exists because the affected software mishandles character rendering. An attacker could exploit this vulnerability by sharing a file withi...

Design/Logic Flaw

A vulnerability in Cisco Webex Teams could allow an unauthenticated, remote attacker to manipulate file names within the messaging interface. The vulnerability exists because the affected software mishandles character rendering. An attacker could exploit this vulnerability by sharing a file withi...

CVE-2021-1242 Cisco Webex Teams Shared File Manipulation Vulnerability

A vulnerability in Cisco Webex Teams could allow an unauthenticated, remote attacker to manipulate file names within the messaging interface. The vulnerability exists because the affected software mishandles character rendering. An attacker could exploit this vulnerability by sharing a file withi...

CVE-2021-1242

CVE-2021-1242 affects Cisco Webex Teams (Webex/Jabber client) where the shared-file name display can be manipulated due to improper character rendering. An unauthenticated, remote attacker could share a file to alter how the file name appears in the messaging interface, enabling phishing or spoof...

CVE-2021-1242 Cisco Webex Teams Shared File Manipulation Vulnerability

A vulnerability in Cisco Webex Teams could allow an unauthenticated, remote attacker to manipulate file names within the messaging interface. The vulnerability exists because the affected software mishandles character rendering. An attacker could exploit this vulnerability by sharing a file withi...

Cisco Jabber and Webex Client Software Shared File Manipulation Vulnerability

A vulnerability in Cisco Jabber and Cisco Webex formerly Teams could allow an unauthenticated, remote attacker to manipulate file names within the messaging interface. The vulnerability exists because the affected software mishandles character rendering. An attacker could exploit this vulnerabili...

Backdoor.Win32.Ketch.b Remote Stack Buffer Overflow

Discovery / credits: malvuln - Malvuln.com c 2021 Original source: https://malvuln.com/advisory/9d7be3799594a82bf7056905f501af03.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Ketch.b Vulnerability: Remote Stack Buffer Overflow Description: Makes HTTP GET reque...

OPENSUSE-SU-2021:0025-1 Security update for kitty

This update for kitty fixes the following issue: - CVE-2020-35605: Fixed an RCE due to filenames containing special characters contained in error messages boo1180298...

Hostname spoofing via backslashes in URL

Overview URI.js is a javascript URL mutation library npm package urijs. In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash \ character followed by an at @ character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library...

CVE-2020-35865

An issue was discovered in the osstrbytes crate before 2.0.0 for Rust. It has false expectations about char::fromu32unchecked behavior...

Hostname Spoofing

urijs is vulnerable to hostname spoofing. The hostname can be spoofed by using a backslash \ character followed by an @ character, which could potentially allow an attacker to bypass authorization if the hostname is used in security decisions...

XXL-JOB cross-site scripting vulnerability (CNVD-2021-44699)

XXL-JOB is a distributed task scheduling platform whose core design goals are rapid development, simple learning, lightweight and easy to extend. A stored cross-site scripting vulnerability exists in XXL-JOB 2.2.0 in the "Add User" section, which can be exploited to bypass a 20-minute vulnerabili...

CVE-2020-29204

XXL-JOB 2.2.0 allows Stored XSS in Add User to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java...

CVE-2020-29204

XXL-JOB 2.2.0 allows Stored XSS in Add User to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java...

CVE-2020-29204

CVE-2020-29204 affects XXL-JOB 2.2.0 with a Stored XSS in the Add User path. The root cause is a bypass of the 20-character limit in xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java, enabling persistent script injection. The NVD and related sources classify the CVSS v3...