PT-2023-29133 · Online Movie Ticket Booking System +1 · Online Movie Ticket Booking System

Name of the Vulnerable Software and Affected Versions: process search.php affected versions not specified Description: The issue is related to the 'search' parameter of the process search.php resource, which does not validate the characters received. As a result, these characters are sent...

CVE-2023-43192

SQL injection can exist in a newly created part of the SpringbootCMS 1.0 background, and the parameters submitted by users are not filtered. As a result, special characters in parameters destroy the original logic of SQL statements. Attackers can use this vulnerability to execute any SQL statemen...

yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`

Impact yt-dlp allows the user to provide shell commands to be executed at various stages in its download process through the --exec flag. This flag allows output template expansion in its argument, so that video metadata values may be used in the shell commands. The metadata fields can be combine...

Medium: python38

Issue Overview: An issue in the urllib.parse component of Python before v3.11 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. CVE-2023-24329 Affected Packages: python38 Note: This advisory is applicable to Amazon Linux 2 - Python3.8 Extra. Vis...

yt-dlp OS Command Injection Vulnerability

yt-dlp is based on the youtube-dl branch of the now inactive youtube-dlc. yt-dlp suffers from an operating system command injection vulnerability that stems from not properly escaping special characters...

Cross Site Scripting (XSS)

librenms/librenms is vulnerable to DOM based Cross Site Scripting XSS. The vulnerability is caused by not sanitizing/escaping HTML special characters in a IPV6/IPV4 search field in includes/html/pages/search/ipv6.inc.php while searching for IPV4/IPv6 addresses. This can result in disclosure of th...

quarkus: HTTP security policy bypass

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized...

sudo-rs Session File Relative Path Traversal vulnerability

Background Sudo-rs allows users to not have to enter authentication at every sudo attempt, but instead only requiring authentication every once in a while in every terminal or process group. Only once a configurable timeout has passed will the user have to re-authenticate themselves. Supporting...

GHSA-2R3C-M6V7-9354 sudo-rs Session File Relative Path Traversal vulnerability

Background Sudo-rs allows users to not have to enter authentication at every sudo attempt, but instead only requiring authentication every once in a while in every terminal or process group. Only once a configurable timeout has passed will the user have to re-authenticate themselves. Supporting...

USN-6378-1: Django vulnerability

It was discovered that Django incorrectly handled certain URIs with a very large number of Unicode characters. A remote attacker could possibly use this issue to cause Django to consume resources or crash, leading to a denial of service...

CVE-2023-39150

ConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code execution. This is related to an incomplete fix for CVE-2022-46387...

Remote code execution

ConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code execution. This is related to an incomplete fix for CVE-2022-46387...

PT-2023-26807 · Conemu · Conemu

Name of the Vulnerable Software and Affected Versions: ConEmu versions prior to commit 230724 Description: The issue is related to the incorrect sanitization of title responses for control characters, potentially leading to arbitrary code execution. This is connected to an incomplete fix for a...

Huawei EulerOS: Security Advisory for sudo (EulerOS-SA-2023-2775)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ASUS RT-AC86U Command Injection Vulnerability (CNVD-2023-70091)

RT-AC86U is an ASUS router with 2900M wireless rate, external antenna, and Gigabit LAN port for WAN access.RT-AC86U integrates ASUS AiProtection, which is equipped with Trend Micro's enterprise-grade network security for smart home networks, even if the connected device does not have anti-virus...

ASUS RT-AC86U OS Command Injection Vulnerability

The ASUS RT-AC86U is a dual-band Wi-Fi router from Asus China. The ASUS RT-AC86U suffers from an operating system command injection vulnerability that stems from insufficient filtering of special characters without using the traditional statistics feature of the traffic analyzer...

Oracle Linux 6 : thunderbird (ELSA-2020-2049)

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-2049 advisory. 68.8.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 68.8.0-1 - Update to 68.8.0 build2 Tenable has...

ASUS RT-AC86U OS Command Injection Vulnerability

The ASUS RT-AC86U is a dual-band Wi-Fi router from ASUS, China. The ASUS RT-AC86U suffers from an operating system command injection vulnerability that stems from insufficient filtering of special characters by the Traffic Analyzer Apps analysis feature...

CLSA-2023-1693904973 Fix CVE(s): CVE-2022-48174

SECURITY UPDATE: unlikely stack overflow vulnerability - debian/patches/CVE-2022-48174.patch: break if a number string containing invalid characters - CVE-2022-48174...

PT-2023-25863 · Unknown +1 · Ocs Inventory Ng +1

Name of the Vulnerable Software and Affected Versions: OCSInventory affected versions not specified Description: The issue allows stored email templates with special characters, leading to a Stored cross-site Scripting. Recommendations: At the moment, there is no information about a newer version...