Cross-site Scripting (XSS)

phoenixhtml is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape the special characters before it outputs to the front end, allowing an attacker to inject and execute malicious JavaScript via HEEx class attributes in tag.ex...

CVE-2022-45541

EyouCMS = 1.6.0 was discovered a reflected-XSS in the article attribute editor component in POST value "value" if the value contains a non-integer char...

Cross-site Scripting (XSS)

dompurify is vulnerable to cross-site scripting XSS attacks. The library does not properly escape the special characters before it output to the front end, allowing an attacker to inject and execute malicious JavaScript via nested headlines...

PT-2023-3591

Name of the Vulnerable Software and Affected Versions Sudo versions prior to 1.9.13 Description The issue is related to a lack of proper encoding or escaping of output in the Sudo program, which can be exploited by a remote attacker to gain access to confidential data. The problem specifically...

PT-2023-3592 · Sudo +10 · Sudo +10

Name of the Vulnerable Software and Affected Versions: Sudo versions prior to 1.9.13 Description: The issue is related to a lack of proper encoding or escaping of output in the Sudo program, specifically in the sudoreplay output. This allows an attacker to potentially gain access to confidential...

Cross-site Scripting (XSS)

innologi/typo3-appointments is vulnerable to cross-site scripting XSS attacks. The library does not properly escape the special characters before it outputs to the front-end, allowing an attacker to inject and execute malicious JavaScript via various formfield values...

GHSA-PFPR-3463-C6JH ruby-git has potential remote code execution vulnerability

The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the git ls-files command using eval to unescape quoted file names. If a file name was added to the git repository contained special characters, such as \n, then the git ls-files command would print the file name in...

Ubuntu: Security Advisory (USN-5788-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Potential remote code execution in ruby-git

The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the 'git ls-files' command using eval to unescape quoted file names. If a file name was added to the git repository contained special characters, such as '\n', then the 'git ls-files' command would print the file nam...

CVE-2022-46304

ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers command injection and allows the attacker to execute arbitrary...

Command injection

ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers command injection and allows the attacker to execute arbitrary...

PT-2023-14901 · Changingtec · Servisign

Name of the Vulnerable Software and Affected Versions: ChangingTec ServiSign affected versions not specified Description: The issue is related to insufficient filtering for special characters in the connection response parameter. This allows an unauthenticated remote attacker to host a malicious...

ServiSign 路径遍历漏洞

Changingtec ServiSign is a system from Changingtec Taiwan, China. The system provides a cross-platform solution for digital signatures and authentication. A security vulnerability exists in ServiSign that stems from insufficient filtering of special characters in the path of a DLL file...

ServiSign 操作系统命令注入漏洞

Changingtec ServiSign is a system from Changingtec Taiwan, China. The system provides a cross-platform solution for digital signatures and authentication. A security vulnerability exists in ServiSign that stems from insufficient filtering of special characters in connection response parameters. A...

Huawei EulerOS: Security Advisory for sqlite (EulerOS-SA-2022-2920)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-43551

A vulnerability exists in curl 7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypasse...

CVE-2022-43551

A vulnerability exists in curl 7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypasse...

DEBIAN-CVE-2022-1834

When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown...

CVE-2021-4221

If a domain name contained a RTL character, it would cause the domain to be rendered to the right of the path. This could lead to user confusion and spoofing attacks. This bug only affects Firefox for Android. Other operating systems are unaffected.Note: Due to a clerical error this advisory was...

CVE-2022-40958

By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session fixation and other attacks. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and...