Weblate: Improper validation of unicode characters

unicode characters are not properly being validated on the https://demo.weblate.org/accounts/profile/preferences in specical character Screenshot showing this is attached below...

Inflection: Limited arbitrary text inclusion in user invite emails

When creating a GoodHire account, a fairly wide range of ASCII characters are permitted in certain fields like Company Name. This field is included in email templates that are automatically sent to new users when an account owner invites them to join a GoodHire account. Theoretically, spam conten...

Authentication Failure When Password Contains £ Character

Authentication for 401 based failure is observed only oniOS devices ,when the password contains £ character, it works for Form based authentication. Authentication for 401 and Form based is working fine without any issue on Android devices ,when the password contains £ character. Coming to RADIUS...

mysql: Incorrect input validation allowing code execution via mysqldump

It was discovered that the mysql and mysqldump tools did not correctly handle database and table names containing newline characters. A database user with privileges to create databases or tables could cause the mysql command to execute arbitrary shell or SQL commands while restoring database...

International Islamic University Chittagong: Reflected XSS

Summary: add summary of the vulnerability Description: search mechanism uses POST method to request for search . So if we change it to get normally the XSS dosen't popup . But if we break it with " this we can get XSS . Platforms Affected: https://ieeeiiucsb.org/search/" Steps To Reproduce: Visit...

DEBIAN-CVE-2017-13720

In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with access to an X connection can cause a buffer over-read during pattern matching of fonts, leading to information disclosure or a crash denial of service. This occurs because '\0'...

Tor: Address Bar Spoofing on TOR Browser

Hi TOR team, I would like to report a security bug in your browser: Step 1: Goto http://www.ոokia.com/http://jsbin.com/wuyikedaxi/1/edit?html,output Step 2: Observe that address bar points to http://www.ոokia.com/ which actually to be pointing to http://xn--okia-zgf.com, however browser displays...

Out of character: Homograph attacks explained

In April, Xudong Zheng, a security enthusiast based in New York, found a flaw in some modern browsers in the way they handle domain names. While Chrome, Firefox, and Opera already have security measures in place to cue users that they might be visiting a destination they thought was legitimate, a...

Easy MPEGAVIDIVXWMVRM to DVD - Enter User Name Local Buffer Overflow (SEH)

Easy MPEGAVIDIVXWMVRM to DVD - Enter User Name Local Buffer Overflow SEH !/usr/bin/python Exploit Title: Easy MPEG/AVI/DIVX/WMV/RM to DVD - 'Enter User Name' Field Buffer Overflow SEH Date: 05-10-2017 Exploit Author: Venkat Rajgor Vendor Homepage: http://www.divxtodvd.net/ Software Link:...

Legal Robot: Allowance of Meta/Null characters

Dear sir, I am very happy to report a vulnerability to legalrobot. Recently, the report 260468 is disclosed publicly and that report describes about the restriction lengths of profile fields "first name and last name". Now, i am reporting an another vulnerability regarding those profile fields...

SQL Injection

WordPress is susceptible to SQL injection attacks. The attacks exist because the library does not check the additional values for placeholders in wpdb-prepare and does not escape percent % characters...

Regular Expression Denial Of Service (ReDoS)

mime is vulnerable to regular expression denial of service ReDoS attacks. The library does not restrict the type of characters that it takes in, causing the application to take a long time to process. A malicious user can use this behaviour to cause a ReDoS...

Regular Expression Denial Of Service (ReDoS)

timespan is vulnerable to regular expression denial of service ReDoS attacks. The library does not restrict the type of characters in a timestamp before parsing it, allowing a malicious user to pass a timestamp to cause a ReDoS...

Regular Expression Denial of Service

Overview Affected versions of marked are vulnerable to a regular expression denial of service. The amplification in this vulnerability is significant, with 1,000 characters resulting in the event loop being blocked for around 6 seconds. Recommendation Update to version 0.3.9 or later. References ...

CVE-2015-5179

FreeIPA might display user data improperly via vectors involving non-printable characters...

DEBIAN-CVE-2015-5179

FreeIPA might display user data improperly via vectors involving non-printable characters...

Design/Logic Flaw

FreeIPA might display user data improperly via vectors involving non-printable characters...

CVE-2015-5179

FreeIPA might display user data improperly via vectors involving non-printable characters...

CVE-2015-5179

FreeIPA might display user data improperly via vectors involving non-printable characters...

CVE-2015-5179

Technical details (affected components, root cause, and patch status) are not publicly provided in the connected documents. Monitor vendor advisories and security trackers for updates.