16244 matches found
Improper Encoding Or Escaping Of Output
php81 is vulnerable to Improper Encoding or Escaping of Output. The vulnerability is due to insufficient escaping when using the procopen command with array syntax, allowing malicious users to execute arbitrary commands in the Windows shell by supplying controlled arguments...
curl: NULL dereference when encoding DN of x509 certificate
Vulnerability description not provided...
CyberChef - The Cyber Swiss Army Knife - A Web App For Encryption, Encoding, Compression And Data Analysis
CyberChef is a simple, intuitive web app for carrying out all manner of "cyber" operations within a web browser. These operations include simple encoding like XOR and Base64, more complex encryption like AES, DES and Blowfish, creating binary and hexdumps, compression and decompression of data,...
PT-2024-32297
Name of the Vulnerable Software and Affected Versions Artifex Ghostscript versions prior to 10.04.0 Description An issue was discovered in the decode utf8 function in base/gp utf8.c of Artifex Ghostscript. This issue is related to overlong UTF-8 encoding, which can lead to possible ../ directory...
U.S. Dept Of Defense: HTML Injection into https://www.██████.mil
HTML Injection vulnerability was identified on the website www.██████.mil. The vulnerability allowed attackers to inject malicious HTML code, which could have compromised the security and integrity of the website. Input validation and output encoding were recommended as mitigations to prevent suc...
curl: Incorrect Encoding Conversion in hostname results in indeterminate SSRF vulnerabilities
Vulnerability description not provided...
curl: Unicode-to-ASCII conversion on Windows can lead to argument injection and more
Vulnerability description not provided...
Exploit for OS Command Injection in Php
CVE-2024-4577 This is a PoC for PHP CVE-2024-4577. Introdu...
python-gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding headers
An HTTP Request Smuggling vulnerability was found in Gunicorn. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly...
python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode()
A flaw was found in the python-idna library. A malicious argument was sent to the idna.encode function can trigger an uncontrolled resource consumption, resulting in a denial of service...
PT-2024-27358
Name of the Vulnerable Software and Affected Versions SAP Financial Consolidation affected versions not specified Description The issue is related to insufficient encoding of user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability. The affected endpoints are exposed over the...
CVE-2024-5585: Improper Encoding or Escaping of Output
In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using procopen command with array syntax, due to insufficient escaping, if the arguments of the executed command ar...
ZendFramework potential Cross-site Scripting vectors due to inconsistent encodings
A number of classes, primarily within the ZendForm, ZendFilter, ZendForm, ZendLog and ZendView components, contained character encoding inconsistencies whereby calls to the htmlspecialchars and htmlentities functions used undefined or hard coded charset parameters. In many of these cases develope...
GHSA-HG35-VQP3-FV39 ZendFramework potential Cross-site Scripting vectors due to inconsistent encodings
A number of classes, primarily within the ZendForm, ZendFilter, ZendForm, ZendLog and ZendView components, contained character encoding inconsistencies whereby calls to the htmlspecialchars and htmlentities functions used undefined or hard coded charset parameters. In many of these cases develope...
GHSA-2RCW-9HRM-8Q7Q TYPO3 Cross-Site Scripting in Frontend User Login
Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile. Template...
GHSA-8M6J-P5JV-V69W TYPO3 Cross-Site Scripting in Online Media Asset Rendering
Failing to properly encode user input, online media asset rendering .youtube and .vimeo files is vulnerable to cross-site scripting. A valid backend user account or write access on the server system e.g. SFTP is needed in order to exploit this vulnerability...
GHSA-85CH-44W7-RF32 TYPO3 Cross-Site Scripting in Fluid ViewHelpers
Failing to properly encode user input, templates using built-in Fluid ViewHelpers are vulnerable to cross-site scripting...
OESA-2024-1700 grub2 security update
GNU GRUB is a Multiboot boot loader. It was derived from GRUB, the GRand Unified Bootloader, which was originally designed and implemented by Erich Stefan Boleyn. Security Fixes: GNU Libtasn1 before 4.19.0 has an ETYPEOK off-by-one array size check that affects asn1encodesimpleder.CVE-2021-46848...
OESA-2024-1699 grub2 security update
GNU GRUB is a Multiboot boot loader. It was derived from GRUB, the GRand Unified Bootloader, which was originally designed and implemented by Erich Stefan Boleyn. Security Fixes: GNU Libtasn1 before 4.19.0 has an ETYPEOK off-by-one array size check that affects asn1encodesimpleder.CVE-2021-46848...
Fedora: Security Advisory for rust-uu_base32 (FEDORA-2024-40ee18b2e7)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...