WakaTime: Missing filteration of meta characters in all full name field on wakatime.com

Hi there Vulnerability Title: Meta characters are not filtered into full name Description You haven't filtered control meta characters such as %00 etc in full name field which allows an attacker to impersonate or hide their real identity within the application. This one is not rejected. It turns...

Weblate: Missing filteration of meta characters in full name field on registration page https://demo.weblate.org/accounts/register

Hi there Vulnerability Title: Meta characters are not filtered into full name on registration page Description You haven't filtered control meta characters such as %00 etc in full name field on registration page which allows an attacker to impersonate or hide their real identity within the...

F5 Networks BIG-IP : Mailx vulnerabilities (K16945)

CVE-2014-7844 The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell meta characters in an email address. CVE-2004-2771 A flaw was found in the way mailx handled the parsing of email addresses...

Debian DSA-3562-1 : tardiff - security update

Several vulnerabilities were discovered in tardiff, a tarball comparison tool. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2015-0857 Rainer Mueller and Florian Weimer discovered that tardiff is prone to shell command injections via shell...

OpenSSH Implementations with X11Forwarding Enabled Should Heed Recent Security Update

Users who choose to enable X11Forwarding in OpenSSH, or those who use software products that re-enable it, should pay close attention to last Wednesday’s OpenSSH security update. The latest version of the open source implementation of the SSH protocol patches a flaw that exposes it to command...

OpenSSH Patches Information Leak Flaw

OpenSSH on Friday last Wednesday dropped a patch for a vulnerability that could expose files to theft and manipulation. The flaw affects all versions of OpenSSH prior to 7.2p2 with X11Forwarding enabled, the OpenSSH project said in its advisory. Unpatched versions of OpenSSH don’t properly saniti...

SOL16945 - Mailx vulnerabilities CVE-2004-2771 and CVE-2014-7844

CVE-2014-7844 The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell meta characters in an email address. CVE-2004-2771 A flaw was found in the way mailx handled the parsing of email addresses...

Debian DLA-114-1 : heirloom-mailx security update

Two security vulnerabilities were discovered in Heirloom mailx, an implementation of the 'mail' command : CVE-2004-2771 mailx interprets interprets shell meta-characters in certain email addresses. CVE-2014-7844 An unexpected feature of mailx treats syntactically valid email addresses as shell...

DSA-3105-1 heirloom-mailx - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3105-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GitList URL Remote Code Execution (CVE-2014-4511)

A code execution vulnerability has been reported in GitList. The vulnerability is due to insufficient input validation for meta-characters passed in the request URL. A remote attacker could exploit this vulnerability by sending a malicious request to the vulnerable server...

Verity Search97 2.1 Security Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/162/info A pair of vulnerabilities exist in Verity's Search97 web interface to the Verity search engine. The first vulnerability is due to cgi-bin scripts, s97cgi and s97rcgi failing to check for the existence of certain...

Debian 2.x,RedHat 6.2,IRIX 5/6, Solaris 2.x Mail Reply-To Field Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1910/info mail is a simple console e-mail client. A vulnerability exists in several vendors' distributions of this program. An attacker can compose an email message with a carefully-formed string in the Reply-To: field...

TalentSoft Web+ Application Server (Linux) 4.6 Example Script File Disclosure

No description provided by source. source: http://www.securityfocus.com/bid/1725/info Web+ is a development language for use in creating web-based client/server applications. In Linux versions of the product, an example script installed in Web+ Web+Ping which fails to correctly filter shell meta...

openSUSE Security Update : dhcpcd (openSUSE-SU-2011:0352-1)

A rogue dhcp server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the dhcp client needs to sanitize the host name offered by the server CVE-2011-0996. This update also fixes...

openSUSE Security Update : aaa_base (openSUSE-SU-2011:0207-1)

shell meta characters in file names could cause interactive shells to execute arbitrary commands when performing tab expansion CVE-2011-0468. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

openSUSE Security Update : dhcp (openSUSE-SU-2011:0321-1)

A rogue dhcp server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the dhcp client needs to sanitize the host name offered by the server CVE-2011-0997. %NASLMINLEVEL 70300 C...

openSUSE Security Update : dhcp (openSUSE-SU-2011:0320-1)

A rogue dhcp server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the dhcp client needs to sanitize the host name offered by the server CVE-2011-0997. %NASLMINLEVEL 70300 C...

openSUSE Security Update : python-cupshelpers (openSUSE-SU-2011:1331-2)

This update fixes a typo from the previous update : system-config-printer used an unauthenticated connection when downloading printer drivers from openprinting.org CVE-2011-4405. This update disables the printer driver download feature. system-config-printer did not properly quote shell meta...

openSUSE Security Update : dhcpcd (openSUSE-SU-2011:0385-1)

A rogue dhcp server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the dhcp client needs to sanitize the host name offered by the server CVE-2011-0996. Note this update is...