4204 matches found
April 7, 2020, update for Office 2016 (KB4484248)
None None...
CVE-2020-7066
In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using getheaders with user-supplied URL, if the URL contains zero \0 character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the getheade...
UBUNTU-CVE-2020-7066
In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using getheaders with user-supplied URL, if the URL contains zero \0 character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the getheade...
Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2020-1341)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
kernel: denial of service via ioctl call in network tun handling
A flaw was found in the Linux kernel's implementation of networking tunnel device ioctl. A local attacker can cause a denial of service NULL pointer dereference and panic via an ioctl TUNSETIFF call with a dev name containing a / character...
The vulnerability of the MOXA EDR-810 industrial router’s web server lies in the lack of a mechanism for filtering specific symbols, allowing attackers to execute arbitrary commands.
The vulnerability of the MOXA EDR-810 industrial router’s web server is related to the absence of a mechanism for filtering specific characters. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by sending specially crafted requests to the web server...
PYSEC-2020-28
In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False...
samba: Crash after failed character conversion at log level 3 or above
A flaw was found in samba. When log levels are set at 3 or higher, the string obtained from the client, after a failed character conversion, is printed which could cause long-lived processes to terminate. The highest threat from this vulnerability is to system availability...
[SECURITY] Fedora 32 Update: nethack-3.6.6-1.fc32
NetHack is a single player dungeon exploration game that runs on a wide variety of computer systems, with a variety of graphical and text interfaces all using the same game engine. Unlike many other Dungeons & Dragons-inspired games, the emphasis in NetHack is on discovering the detail of the...
PT-2020-6958 · Artifex +1 · Ghostscript +1
Name of the Vulnerable Software and Affected Versions: Artifex Ghostscript versions prior to 9.53.0 Description: The issue is related to an out-of-bounds write and use-after-free in the devices/vector/gdevtxtw.c component of Ghostscript, specifically affecting the txtwrite functionality. This...
CVE-2020-10113
cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...
CVE-2020-10113
cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...
Design/Logic Flaw
cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...
PT-2020-2412 · Php +8 · Php +8
Name of the Vulnerable Software and Affected Versions: PHP versions 7.2.x through 7.2.28 PHP versions 7.3.x through 7.3.15 PHP versions 7.4.x through 7.4.3 Description: The issue is related to the implementation of the get headers function in PHP, which does not properly check user-supplied URLs...
X (Formerly Twitter): character limitation bypass can lead to DoS on Twitter App and 500 Internal Server Error
Summary: If you are creating a new moment on https://twitter.com/username/moments you get redirected to https://twitter.com/i/moments/edit/moments-id. There you can set a title, a description and also you can add, if you want, a Tweet to your Moment. The title and also the description are...
CVE-2019-13393
The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses the same default 8 character passphrase for the administrative console and the WPA2 pre-shared key. Either an attack against HTTP Basic Authentication or an attack against WPA2 could be used to determine this passphrase...
CVE-2019-12278
Opera through 53 on Android allows Address Bar Spoofing. Characters from several languages are displayed in Right-to-Left order, due to mishandling of several Unicode characters. The rendering mechanism, in conjunction with the "first strong character" concept, may improperly operate on a numeric...
CVE-2019-12278
The CVE-2019-12278 vulnerability affects Opera for Android up to version 53, where Address Bar Spoofing can occur due to mishandling of Unicode characters with Right‑to‑Left ordering and the first-strong character heuristic. This can allow a spoofed URL to be displayed, potentially misleading use...
Command injection
An issue was discovered in Poly formerly Polycom HDX 3.1.13. A feature exists that allows the creation of a server / client certificate, or the upload of the user certificate, on the administrator's page. The value received from the user is the factor value of a shell script on the equipment. By...