6375 matches found
Denial Of Service (DoS)
dlt-daemon is vulnerable to Denial Of Service DoS. The vulnerability exists because the configuration file fails to generate dlt logs in the system when that file contains special characters, allowing an attacker to cause an application crash...
SUSE-SU-2023:0707-1 Security update for python39
This update for python39 fixes the following issues: - CVE-2023-24329: Fixed blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters bsc1208471. Update to 3.9.16: - python -m http.server no longer allows terminal control characters sent within a...
Cross-site Scripting (XSS)
orchardcore is vulnerable to Cross-site Scripting XSS attacks. The library does not properly escape the special characters before it output to the front end, allowing an attacker to inject log entries into the database logs, containing a malicious referrer field...
Debian: Security Advisory (DLA-473-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2023-27522
HTTP Response Smuggling vulnerability in Apache HTTP Server via modproxyuwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client...
Design/Logic Flaw
HTTP Response Smuggling vulnerability in Apache HTTP Server via modproxyuwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client...
CVE-2023-27522
HTTP Response Smuggling vulnerability in Apache HTTP Server via modproxyuwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client...
CVE-2023-27522
HTTP Response Smuggling vulnerability in Apache HTTP Server via modproxyuwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client...
CVE-2023-27522 Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting
HTTP Response Smuggling vulnerability in Apache HTTP Server via modproxyuwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client...
Cross-site Scripting (XSS)
rsshub is vulnerable to Cross-site Scripting XSS attacks. The vulnerability is due to the URL parameter improperly sanitizating special characters, which allows an attacker to inject and execute malicious JavaScript through the error page on a victim's browser...
CVE-2023-26047
teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used...
CVE-2023-25403
CleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass. The program uses a fixed JWT key, and the stored key uses username format characters. Any user who logged in within 24 hours. A token can be forged with his username to bypass authentication...
Denial Of Service (DoS)
lite-web-server is vulnerable to Denial Of Service DoS. The vulnerability exists due to the decodeURIComponent function which is unable to parse control characters, allowing an attacker to cause an application crash...
Updated tar packages fix security vulnerability
GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in fromheader in list.c via a V7 archive in which mtime has approximately 11 whitespace...
rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters
Impact When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. Patches This vulnerability was...
GHSA-32GR-4CQ6-5W5Q rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters
Impact When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. Patches This vulnerability was...
PT-2023-20449 · Teler-Waf · Teler-Waf
Name of the Vulnerable Software and Affected Versions: teler-waf versions prior to 0.2.0 Description: teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. The issue allows an attacker to execute arbitrary JavaScript code on the victim's...
PT-2023-20681 · Rsshub · Rsshub
Name of the Vulnerable Software and Affected Versions: RSSHub versions prior to c910c4d28717fb860fbe064736641f379fab2c91 Description: RSSHub is an open source and extensible RSS feed generator. When the URL parameters contain certain special characters, it returns an error page that does not...
Denial Of Service (DoS)
tar is vulnerable to Denial Of Service DoS. The vulnerability exists due to the one-byte out-of-bounds read that results in the use of uninitialized memory for a conditional jump, allowing an attacker to cause an application crash through the fromheader in list.c via a V7 archive in which mtime h...
GHSA-8237-3Q5G-99FV Denial of Service vulnerability in lite-web-server
All versions of the package lite-web-server are vulnerable to Denial of Service DoS when an attacker sends an HTTP request and includes control characters that the decodeURI function is unable to parse...