CVE-2023-5723

An attacker with temporary script access to a site could have set a cookie containing invalid characters using document.cookie that could have led to unknown errors. This vulnerability affects Firefox 119...

CVE-2023-5732

An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited. This vulnerability affects Firefox 117, Firefox ESR 115.4, and Thunderbird 115.4.1...

UBUNTU-CVE-2023-5723

An attacker with temporary script access to a site could have set a cookie containing invalid characters using document.cookie that could have led to unknown errors. This vulnerability affects Firefox 119...

Mozilla Firefox Security Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox versions prior to 119. An attacker could use the vulnerability to set a cookie containing invalid characters using "document.cookie"...

CVE-2023-5732

An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited. This vulnerability affects Firefox 117, Firefox ESR 115.4, and Thunderbird 115.4.1...

Mozilla Firefox ESR Security Vulnerability

Mozilla Firefox ESR is an extended support release of Firefox web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox ESR version 115.4, which originates from the creation of a malicious link through the use of bidirectional characters that...

SUSE: Security Advisory (SUSE-SU-2023:3563-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Vulnerabilities fixed in Firefox ESR 115.4 — Mozilla

It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay. An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited. Drivers a...

PT-2023-6538 · Mozilla +9 · Firefox +11

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 117 Firefox ESR versions prior to 115.4 Thunderbird versions prior to 115.4.1 Description: The issue is related to errors in the representation of information in the user interface, allowing an attacker to conduct...

Code injection

iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The hostname's initial character may be non-alphanumeric. The hostname's other characters may be outside the set of alphanumeric characters, dash, and period...

openssl: c_rehash script allows command injection

A flaw was found in OpenSSL. The crehash script does not properly sanitize shell meta-characters to prevent command injection. Some operating systems distribute this script in a manner where it is automatically executed. This flaw allows an attacker to execute arbitrary commands with the privileg...

Ctxexceptionhandler.exe creates dump files under C:\ drive in VDA

Dump files .dmp files with special characters are generated under C:\ drive in VDA randomly...

Medium: sudo

Issue Overview: Sudo before 1.9.13 does not escape control characters in log messages. CVE-2023-28486 Sudo before 1.9.13 does not escape control characters in sudoreplay output. CVE-2023-28487 Affected Packages: sudo Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit...

CLSA-2023-1697575950 Fix CVE(s): CVE-2023-4504

SECURITY UPDATE: heap-based buffer overflow - debian/patches/CVE-2023-4504.patch: check for end of buffer if there is an escaped character - CVE-2023-4504...

FreshTomato 操作系统命令注入漏洞

FreshTomato is a Linux-based open source firmware from FreshTomato Open Source. The firmware provides a variety of features for Broadcom-based routers. A command execution vulnerability exists in FreshTomato version 2023.3, which stems from the application failing to properly filter construct...

CVE-2023-30805

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the /LogInOut.php endpoint. This is due to mishandling ...

Denial Of Service (DoS)

libvips.so is vulnerable to Denial of Service DoS. The vulnerability is due improper UTF-8 character handling in svgload.c because it does not properly validate malformed characters, which allows an attacker to cause an application crash or potentially execute arbitrary code...

SUSE CVE-2023-43665

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars and words methods when used with html=True are subject to a potential DoS denial of service attack via certain inputs with very long, potentially malformed HTML text. The chars and words...

Untrusted Search Path

python is vulnerable to Untrusted Search Path. The vulnerability is due to the Pynormpath function which cannot process paths with embedded null characters without truncating the path. If a path containing the \0 byte is passed to os.path.normpath, the path will be truncated unexpectedly at the...

GLSA-202309-12 : sudo: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202309-12 sudo: Multiple Vulnerabilities - Sudo before 1.9.13p2 has a double free in the per-command chroot feature. CVE-2023-27320 - Sudo before 1.9.13 does not escape control characters in log messages. CVE-2023-28486 - Sudo...