127 matches found
SUSE CVE-2026-23920
Host and event action script input is validated with a regex set by the administrator, but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands...
EUVD-2026-14952
Host and event action script input is validated with a regex set by the administrator, but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands...
DEBIAN-CVE-2026-23920
Host and event action script input is validated with a regex set by the administrator, but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands...
CVE-2026-23920
Host and event action script input is validated with a regex set by the administrator, but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands...
CVE-2026-23920
Host and event action script input is validated with a regex set by the administrator, but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands...
UBUNTU-CVE-2026-23920
Host and event action script input is validated with a regex set by the administrator, but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands...
CVE-2026-23920
The CVE describes a bypass of input validation for host and event action scripts where a regex (admin-set) is evaluated in multiline mode. If ^ and $ anchors are used in input validation, an injected newline can bypass the check and allow authenticated users to inject shell commands. The descript...
CVE-2026-23920
Host and event action script input is validated with a regex set by the administrator, but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands...
CVE-2026-23920
Host and event action script input is validated with a regex set by the administrator, but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands...
CVE-2026-23920 Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection
Host and event action script input is validated with a regex set by the administrator, but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands...
CVE-2026-23920: Improper Neutralization of Special Elements used in an OS Command
Host and event action script input is validated with a regex set by the administrator, but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands...
PT-2026-27474
Name of the Vulnerable Software and Affected Versions Zabbix affected versions not specified Description The regular expression used for validating host and event action script input allows bypass of the validation check when multiline mode is enabled. Specifically, the use of anchors ^ and $ in...
OPENSUSE-SU-2026:20235-1 Security update for fontforge
This update for fontforge fixes the following issues: Update to version 20251009. Security issues fixed: - CVE-2025-15279: remote code execution via heap-based buffer overflow in BMP file parsing bsc1256013. - CVE-2025-15269: remote code execution via use-after-free in SFD file parsing bsc1256032...
MiracleLinux 8 : nodejs:14 (AXSA:2022-3839:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3839:01 advisory. nodejs: DNS rebinding in --inspect via invalid IP addresses CVE-2022-32212 nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding...
CVE-2019-11835
cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments...
EUVD-2019-3498
Malware in sbrugna...
EUVD-2024-50186
Malicious code in bioql PyPI...
Heap-based Buffer Overflow
Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the uclparsemultilinestring function. An attacker with local access can cause a lack of system availability by providing specially crafted input to this function during parsing operations. Remediation A fi...
CVE-2025-6499 vstakhov libucl ucl_parser.c ucl_parse_multiline_string heap-based overflow
A vulnerability classified as problematic was found in vstakhov libucl up to 0.9.2. Affected by this vulnerability is the function uclparsemultilinestring of the file src/uclparser.c. The manipulation leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has...
libucl 安全漏洞
libucl is a C general configuration library parser from the individual developer Vsevolod Stakhov. A security vulnerability exists in libucl 0.9.2 and earlier versions, which stems from a heap buffer overflow in the uclparsemultilinestring function in the src/uclparser.c file...