ROS-20250710-06

The Redis database management system DBMS vulnerability is related to boundary checking errors in parsing file names. Exploitation of the vulnerability could allow an attacker to execute arbitrary code...

CVE-2025-0638 Routinator crashes when illegal characters are present in manifest file names

The initial code parsing the manifest did not check the content of the file names yet later code assumed that it was checked and panicked when encountering illegal characters, resulting in a crash of Routinator...

SUSE CVE-2019-9021

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the...

php: Heap-based buffer over-read in PHAR reading functions

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the...

Novell iPrint Client < 5.78 Multiple Code Execution Vulnerabilities

The version of Novell iPrint Client installed on the remote host is earlier than 5.78. Such versions are reportedly affected by one or more of the following vulnerabilities that can allow for arbitrary code execution : - An unspecified issue exists in the GetDriverSettings realm in nipplib.dll...

Get apache the file name parsing flaw vulnerability-vulnerability warning-the black bar safety net

apache file name parsing, is to start from the back to check the suffix, according to the last legitimate the suffix implementation. Such as: cmdshell. php. amxku because amxku is not apache to parse, so the apache put this file when the php file parsing. 可以 参见 http://www.4ngel.net/article/63.htm...

SHTTPD文件名解析错误信息泄露漏洞

BUGTRAQ ID: 24618 CVECAN ID: CVE-2007-3407 SHTTPD是一款轻量级的简单易用的web服务器。 SHTTPD处理HTTP请求时存在漏洞，远程攻击者可能利用此漏洞获取脚本源码。 SHTTPD没有正确地处理HTTP请求，如果用户在所提交的URI后附加了“%20”字符的话，就可能导致泄露某些脚本的源码。 Sergey Lyubka SHTTPD 1.38 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://shttpd.sourceforge.net/...