PT-2023-26807 · Conemu · Conemu

Name of the Vulnerable Software and Affected Versions: ConEmu versions prior to commit 230724 Description: The issue is related to the incorrect sanitization of title responses for control characters, potentially leading to arbitrary code execution. This is connected to an incomplete fix for a...

Huawei EulerOS: Security Advisory for sudo (EulerOS-SA-2023-2775)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ASUS RT-AC86U Command Injection Vulnerability (CNVD-2023-70091)

RT-AC86U is an ASUS router with 2900M wireless rate, external antenna, and Gigabit LAN port for WAN access.RT-AC86U integrates ASUS AiProtection, which is equipped with Trend Micro's enterprise-grade network security for smart home networks, even if the connected device does not have anti-virus...

ASUS RT-AC86U OS Command Injection Vulnerability

The ASUS RT-AC86U is a dual-band Wi-Fi router from Asus China. The ASUS RT-AC86U suffers from an operating system command injection vulnerability that stems from insufficient filtering of special characters without using the traditional statistics feature of the traffic analyzer...

Oracle Linux 6 : thunderbird (ELSA-2020-2049)

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-2049 advisory. 68.8.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 68.8.0-1 - Update to 68.8.0 build2 Tenable has...

ASUS RT-AC86U OS Command Injection Vulnerability

The ASUS RT-AC86U is a dual-band Wi-Fi router from ASUS, China. The ASUS RT-AC86U suffers from an operating system command injection vulnerability that stems from insufficient filtering of special characters by the Traffic Analyzer Apps analysis feature...

CLSA-2023-1693904973 Fix CVE(s): CVE-2022-48174

SECURITY UPDATE: unlikely stack overflow vulnerability - debian/patches/CVE-2022-48174.patch: break if a number string containing invalid characters - CVE-2022-48174...

PT-2023-25863 · Unknown +1 · Ocs Inventory Ng +1

Name of the Vulnerable Software and Affected Versions: OCSInventory affected versions not specified Description: The issue allows stored email templates with special characters, leading to a Stored cross-site Scripting. Recommendations: At the moment, there is no information about a newer version...

Huawei EulerOS: Security Advisory for shadow (EulerOS-SA-2023-2710)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for sudo (EulerOS-SA-2023-2712)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-7994

Name of the Vulnerable Software and Affected Versions Django versions 3.2 through 3.2.20 Django versions 4.1 through 4.1.10 Django versions 4.2 through 4.2.4 Description The issue is related to the django.utils.encoding.uri to iri component of the Django web application platform, which is...

Path Traversal

pyramid is vulnerable to Path Traversal. The vulnerability exists because static.py does not properly remove null-byte characters from the path element, which allows an attacker to gain access to index.html located exactly one directory above the location of the static view's file system path...

The vulnerability of the urllib.parse library component in the Python programming language allows attackers to circumvent URL blocking measures.

The vulnerability of the urllib.parse language interpreter component in Python is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass URL blockings that start with empty characters...

CVE-2023-38029

Saho’s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service...

Design/Logic Flaw

Saho’s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service...

Saho ADM100 、ADM-100FP 代码问题漏洞

Saho ADM100 and Saho ADM-100FP are both full-service security devices from Saho. Saho attendance devices ADM100 , ADM-100FP has a code issue vulnerability, the vulnerability stems from insufficient filtering of special characters and file types in the file upload function, a remote attacker...

xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e. neither alphanumeric nor underscore) aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature.

...

CVE-2023-40359

xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters i.e., neither alphanumeric nor underscore, aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature...

CVE-2023-3265

An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login into the application with the default user "cyberpower" by appending a non-printable character.An unauthenticated attacker can leverage this...

CVE-2023-3265

An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login into the application with the default user "cyberpower" by appending a non-printable character.An unauthenticated attacker can leverage this...