6334 matches found
Struts ParameterInterceptor vulnerability allows remote command execution
Regular expression in ParametersInterceptor matches top'foo' as a valid expression, which OGNL treats as top'foo'0 and evaluates the value of 'foo' action parameter as an OGNL expression. This lets malicious users put arbitrary OGNL statements into any String variable exposed by an action and hav...
CLSA-2022-1650575983 Fix of CVE: CVE-2021-27135
CVE-2021-27135: fix crash when processing combining characters...
Fix of CVE: CVE-2021-27135
CVE-2021-27135: fix crash when processing combining characters...
GitLab 0.8.0 < 14.2.6 / 14.3 < 14.3.4 / 14.4 < 14.4.1 (CVE-2021-39908)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 certain Unicode characters can be...
SUSE-SU-2022:0942-2 Security update for python3
This update for python3 fixes the following issues: - CVE-2021-3572: Fixed an improper handling of unicode characters in pip bsc1186819...
Elcomplus SmartPPT č·Æå¾éåę¼ę“
Elcomplus SmartPPT is an integrated voice and data scheduling software from Elcomplus USA. A path traversal vulnerability exists in Elcomplus SmartPPT that stems from the software using external input to construct a pathname that should be located in a restricted directory, but it fails to...
netty: control chars in header names may lead to HTTP request smuggling
A flaw was found in Netty, specifically in the netty-codec-http package. This flaw allows unauthorized control characters at the beginning and end of a request, does not follow the specification, and can cause HTTP request smuggling...
Tukaani XZ Utils xzgrep Argument Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tukaani XZ Utils. Interaction with this script is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of...
RHEL 6 : expat (RHSA-2022:1309)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1309 advisory. Expat is a C library for parsing XML documents. Security Fixes: expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code...
U.S. Dept Of Defense: Reflected XSS via `āāāāāāāā` parameter
Hello everyone, I came across a page that allows users to subscribe to certain forum posts at https://āāā I noticed that the āāāā parameter is reflected in the Page without filtering dangerous characters such as except the = character which is filtered by default, but this can be circumvented by...
CVE-2022-26675
aEnrich a+HRD has inadequate filtering for special characters in URLs. An unauthenticated remote attacker can bypass authentication and perform path traversal attacks to access arbitrary files under website root directory...
CVE-2022-23971
ASUS RT-AX56Uās updatePLC/PORT file has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated LAN attacker can overwrite a system file by uploading another PLC/PORT file with the same file name, which results in service...
Path traversal
ASUS RT-AX56Uās updatejson function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated LAN attacker can overwrite a system file by uploading another file with the same file name, which results in service disruption...
CVE-2022-26670
CVE-2022-26670 concerns the D-Link DIR-878 wireless router. The vulnerability stems from inadequate filtering for special characters in a webpage input field, enabling an unauthenticated LAN attacker to perform a command injection and execute arbitrary system commands. The available connected sou...
ROS-20220407-03
A vulnerability in the Python client library is related to insufficient validation of user input data in the FTP File Transfer Protocol library when used in PASV passive mode in the FTP File Transfer Protocol library when it is used in PASV passive mode. Exploitation the vulnerability could allow...
Cross-site Scripting (XSS)
uri.js is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization of \r CR, \n, LF \t TAB of the URI allowing an attacker to inject maliciously crafted script into the system...
Cross site scripting
The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUESTURI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters...
Code injection
In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 certain Unicode characters can be abused to commit malicious code into projects without being noticed in merge request or source code...
The vulnerability of the XML DOM implementation lies in the lack of mechanisms for encoding or escaping output data, allowing attackers to compromise the integrity of the data.
The vulnerability of the XML DOM implementation is related to improper filtering of special characters. Exploiting this vulnerability allows an attacker to compromise data integrity remotely...
Security update for python (moderate)
openSUSE Security Update: Security update for python Announcement ID: openSUSE-SU-2022:1091-1 Rating: moderate References: 1175619 1186819 1194146 1195396 Cross-References: CVE-2021-3572 CVE-2021-4189 CVE-2022-0391 CVSS scores: CVE-2021-3572 SUSE: 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N...