EulerOS Virtualization 2.9.0 : lldpad (EulerOS-SA-2021-1658)

According to the version of the lldpad package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This...

EulerOS Virtualization 3.0.6.6 : lldpad (EulerOS-SA-2021-1497)

According to the version of the lldpad package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This...

SUSE-SU-2021:0515-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: - CVE-2020-26116: Raise ValueError if method contains control characters and thus prevent CRLF injection into URLs bsc1177211...

Updated python-urllib3 packages fix security vulnerability

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest CVE-2020-26137...

EulerOS 2.0 SP8 : lldpad (EulerOS-SA-2020-2519)

According to the version of the lldpad package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an...

BigBlueButton has an unspecified vulnerability

BigBlueButton is an open source Web conferencing system from the BigBlueButton community. security vulnerabilities exist in versions prior to BigBlueButton 2.2.29, the source of the vulnerability lacks cleanup for certain parameters, as evidenced by the control characters in the accepted username...

CVE-2020-28954

web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting control characters in a user name...

Code injection

web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting control characters in a user name...

BigBlueButton 安全漏洞

BigBlueButton is an open source Web conferencing system from the BigBlueButton community. security vulnerabilities exist in versions prior to BigBlueButton 2.2.29, the source of the vulnerability lacks cleanup for certain parameters, as evidenced by the control characters in the accepted username...

EulerOS 2.0 SP5 : lldpad (EulerOS-SA-2020-2290)

According to the version of the lldpad package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an...

EulerOS 2.0 SP9 : lldpad (EulerOS-SA-2020-2234)

According to the version of the lldpad package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an...

Huawei EulerOS: Security Advisory for lldpad (EulerOS-SA-2020-2234)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP9 : lldpad (EulerOS-SA-2020-2233)

According to the version of the lldpad package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an...

FreeBSD : Python -- multiple vulnerabilities (33c05d57-bf6e-11ea-ba1e-0800273f78d3)

Python reports : The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service. Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben Caller and Matt Schwage...

Privilege Escalation

ruby is vulnerable to privilege escalation. It was found that WEBrick the Ruby HTTP server toolkit did not filter terminal escape sequences from its log files. A remote attacker could use specially-crafted HTTP requests to inject terminal escape sequences into the WEBrick log files. If a victim...

Python -- multiple vulnerabilities

Python reports: bpo-41304: Fixes python3x.pth being ignored on Windows, caused by the fix for bpo-29778 CVE-2020-15801. bpo-39603: Prevent http header injection by rejecting control characters in http.client.putreques...

CVE-2020-8445

In OSSEC-HIDS 2.7 through 3.5.0, the OSCleanMSG function in ossec-analysisd doesn't remove or encode terminal control characters or newlines from processed log messages. In many cases, those characters are later logged. Because newlines \n are permitted in messages processed by ossec-analysisd, i...

CVE-2020-8445

In OSSEC-HIDS 2.7 through 3.5.0, the OSCleanMSG function in ossec-analysisd doesn't remove or encode terminal control characters or newlines from processed log messages. In many cases, those characters are later logged. Because newlines \n are permitted in messages processed by ossec-analysisd, i...

PT-2020-20145 · Trend Micro · Ossec-Hids

Name of the Vulnerable Software and Affected Versions: OSSEC-HIDS versions 2.7 through 3.5.0 Description: The issue arises from the OS CleanMSG function in ossec-analysisd, which fails to remove or encode terminal control characters or newlines from processed log messages. This can lead to the...

Insecure Shell-Characters Sanitization

lldpad does not properly sanitize shell control characters. An attacker is able to inject shell control characters into the buffer and cause unexpected behavior in the terminal. This is due to raw and unsanitized buffer being displayed when mngAddr information is displayed...