12141 matches found
From trust to trickery: Brand impersonation over the email attack vector
Cisco recently developed and released a new feature to detect brand impersonation in emails when adversaries pretend to be a legitimate corporation. Talos has discovered a wide range of techniques threat actors use to embed and deliver brand logos via emails to their victims. Talos is providing n...
glibc: Out of bounds write in iconv may lead to remote code execution
An out-of-bounds write flaw was found in the ISO-2022-CN-EXT plugin for glibc's iconv library. When converting from UCS4 charset, adding certain escape charterers is required to indicate where the charset was changed to the library. During this process, iconv improperly checks the boundaries of...
Litespeed Technologie OpenLiteSpeed 安全漏洞
Litespeed Technologie OpenLiteSpeed is an open source web server from Litespeed Technologie. A security vulnerability exists in versions of OpenLiteSpeed prior to 1.8.1 that stems from an inability to properly handle chunked encoding...
PT-2024-24157 · Unknown · Openlitespeed
Name of the Vulnerable Software and Affected Versions: OpenLiteSpeed versions prior to 1.8.1 Description: The issue is related to the mishandling of chunked encoding. Recommendations: For versions prior to 1.8.1, update to version 1.8.1 or later to resolve the issue...
RHEL 9 : Red Hat OpenStack Platform 17.1 (python-gunicorn) (RHSA-2024:2727)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:2727 advisory. Gunicorn Green Unicorn is a Python WSGI HTTP server for UNIX Security Fixes: HTTP Request Smuggling due to improper validation of Transfer-Encoding...
DEBIAN-CVE-2021-47401
In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix stack information leak The tty driver name is used also after registering the driver and must specifically not be allocated on the stack to avoid leaking information to user space or triggering an oops. Driver...
UBUNTU-CVE-2021-47401
In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix stack information leak The tty driver name is used also after registering the driver and must specifically not be allocated on the stack to avoid leaking information to user space or triggering an oops. Driver...
DEBIAN-CVE-2024-35919
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect encoder context list Add a lock for the ctxlist, to avoid accessing a NULL pointer within the 'vpuencipihandler' function when the ctxlist has been deleted due to an unexpected...
SAP NetWeaver AS ABAP XSS (May 2024) (3450286)
The remote SAP NetWeaver ABAP server may be affected by a cross-site scripting XSS vulnerability. A cross-site scripting XSS vulnerability exists due to improper validation and encoding of untrusted data. An unauthenticated, remote attacker can exploit this, by convincing a user to click a...
The vulnerability of the Apache Maven framework, related to improper encoding or output filtering, allows attackers to execute injection attacks through command-line interfaces.
The vulnerability of the Apache Maven framework is related to the generation of strings in double quotes without proper encapsulation. Exploiting this vulnerability allows an attacker to perform injection attacks through the command shell...
Oceanic allows unsanitized user input to lead to path traversal in URLs
Impact Input to functions such as Client.rest.channels.removeBan is not url-encoded, resulting in specially crafted input such as ../../../channels/id being normalized into the url /api/v10/channels/id, and deleting a channel rather than removing a ban. Workarounds Sanitizing user input, ensuring...
GHSA-5H5V-HW44-F6GG Oceanic allows unsanitized user input to lead to path traversal in URLs
Impact Input to functions such as Client.rest.channels.removeBan is not url-encoded, resulting in specially crafted input such as ../../../channels/id being normalized into the url /api/v10/channels/id, and deleting a channel rather than removing a ban. Workarounds Sanitizing user input, ensuring...
CVE-2024-34687
SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. An attacker can control code that is executed within a user’s browser, which could result in modification, deletion of data, includin...
CVE-2024-34712
Oceanic is a NodeJS library for interfacing with Discord. Prior to version 1.10.4, input to functions such as Client.rest.channels.removeBan is not url-encoded, resulting in specially crafted input such as ../../../channels/id being normalized into the url /api/v10/channels/id, and deleting a...
CVE-2024-34687
SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. An attacker can control code that is executed within a user’s browser, which could result in modification, deletion of data, includin...
CVE-2024-32733
Due to missing input validation and output encoding of untrusted data, SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject malicious JavaScript code into the dynamically crafted web page. On successful exploitation the attacker can access or modify...
DEBIAN-CVE-2024-33875
HDF5 Library through 1.14.3 has a heap-based buffer overflow in H5Olayoutencode in H5Olayout.c, resulting in the corruption of the instruction pointer...
AZL-40699 CVE-2024-33875 affecting package hdf5 for versions less than 1.14.4-1
HDF5 Library through 1.14.3 has a heap-based buffer overflow in H5Olayoutencode in H5Olayout.c, resulting in the corruption of the instruction pointer...