CVE-2023-28487

CVE-2023-28487 affects sudo up to version 1.9.13, where sudoreplay output does not escape control characters. This can enable manipulation of terminal output when viewed. Public details in connected advisories indicate fixes implemented in 1.9.13 and newer across multiple distributions (Debian, A...

Sudo 安全漏洞

Sudo is a program used on Unix-like systems that allows users to execute commands in a secure manner with special privileges. A security vulnerability exists in versions of Sudo prior to 1.9.13 that stems from the fact that Sudo does not escape control characters in sudoreplay output...

CVE-2023-28487

Sudo before 1.9.13 does not escape control characters in sudoreplay output...

CVE-2023-28486

CVE-2023-28486 affects the sudo utility; the affected component is sudo prior to version 1.9.13, which does not escape control characters in log messages. Multiple connected advisories confirm the issue and subsequent fixes across distributions (e.g., Debian LTS advisory DLA-4472-1 for sudo 1.9.5...

PT-2023-2285 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno versions prior to 1.31.2 Description: The issue is related to the lack of filtering for special control characters in Deno, a runtime for JavaScript and TypeScript. This allows a malicious program to clear the first two lines of a prompt...

Sudo 安全漏洞

Sudo is a program used on Unix-like systems that allows users to execute commands in a secure manner with special privileges. A security vulnerability exists in versions of Sudo prior to 1.9.13 that stems from the fact that Sudo does not escape control characters in log messages...

SUSE-SU-2023:0707-1 Security update for python39

This update for python39 fixes the following issues: - CVE-2023-24329: Fixed blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters bsc1208471. Update to 3.9.16: - python -m http.server no longer allows terminal control characters sent within a...

Debian: Security Advisory (DLA-473-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Denial Of Service (DoS)

lite-web-server is vulnerable to Denial Of Service DoS. The vulnerability exists due to the decodeURIComponent function which is unable to parse control characters, allowing an attacker to cause an application crash...

GHSA-8237-3Q5G-99FV Denial of Service vulnerability in lite-web-server

All versions of the package lite-web-server are vulnerable to Denial of Service DoS when an attacker sends an HTTP request and includes control characters that the decodeURI function is unable to parse...

CVE-2023-26104

All versions of the package lite-web-server are vulnerable to Denial of Service DoS when an attacker sends an HTTP request and includes control characters that the decodeURI function is unable to parse...

CVE-2023-26104

All versions of the package lite-web-server are vulnerable to Denial of Service DoS when an attacker sends an HTTP request and includes control characters that the decodeURI function is unable to parse...

CVE-2023-26104

The CVE-2023-26104 entry concerns lite-web-server. Affected: lite-web-server library; Root cause: DoS triggered when an HTTP request includes control characters that decodeURI() cannot parse, leading to an availability impact (DoS). Exploitation details are documented in Snyk (PoC) and GitHub ref...

CVE-2023-26104

All versions of the package lite-web-server are vulnerable to Denial of Service DoS when an attacker sends an HTTP request and includes control characters that the decodeURI function is unable to parse...

SUSE CVE-2008-5508

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly parse URLs with leading whitespace or control characters, which might allow remote attackers to misrepresent URLs and simplify phishing attacks...

SUSE CVE-2014-3146

Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting XSS attacks via control characters in the link scheme to the cleanhtml function...

USN-5848-1 less vulnerability

David Leadbeater discovered that less was not properly handling escape sequences when displaying raw control characters. A maliciously formed OSC 8 hyperlink could possibly be used by an attacker to cause a denial of service...

PT-2023-3591

Name of the Vulnerable Software and Affected Versions Sudo versions prior to 1.9.13 Description The issue is related to a lack of proper encoding or escaping of output in the Sudo program, which can be exploited by a remote attacker to gain access to confidential data. The problem specifically...

PT-2023-3592 · Sudo +10 · Sudo +10

Name of the Vulnerable Software and Affected Versions: Sudo versions prior to 1.9.13 Description: The issue is related to a lack of proper encoding or escaping of output in the Sudo program, specifically in the sudoreplay output. This allows an attacker to potentially gain access to confidential...

Huawei EulerOS: Security Advisory for sqlite (EulerOS-SA-2022-2920)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...