CVE-2024-21891

Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experiment...

CVE-2024-21891

Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experiment...

PT-2024-3905

Name of the Vulnerable Software and Affected Versions: Node.js versions 20 through 21 Description: The issue is related to the experimental permission model in Node.js, where user-defined implementations can overwrite built-in utility functions used to normalize paths provided to node:fs function...

Hands-On Review: SASE-based XDR from Cato Networks

Companies are engaged in a seemingly endless cat-and-mouse game when it comes to cybersecurity and cyber threats. As organizations put up one defensive block after another, malicious actors kick their game up a notch to get around those blocks. Part of the challenge is to coordinate the defensive...

CVE-2024-23826

spbusesite is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an avatar image, an authenticated user may intentionally use a large Unicode filename which would lead to a server-side denial of service under Windows. This is...

CVE-2024-23826 Uploading an image with a specific filename causes a server-side DoS

spbusesite is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an avatar image, an authenticated user may intentionally use a large Unicode filename which would lead to a server-side denial of service under Windows. This is...

CVE-2024-23826

The CVE-2024-23826 affects the spbu_se_site web application (St. Petersburg State University). Before 2024-01-29, authenticated users could upload an avatar image with a very large Unicode filename, triggering a server-side DoS on Windows due to unbounded filename length and costly Unicode normal...

CVE-2024-23826 Uploading an image with a specific filename causes a server-side DoS

spbusesite is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an avatar image, an authenticated user may intentionally use a large Unicode filename which would lead to a server-side denial of service under Windows. This is...

PT-2024-20108 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: spbu se site versions prior to 2024.01.29 Description: The issue arises when an authenticated user uploads an avatar image with a large Unicode filename, leading to a server-side denial of service under Windows. This is due to the lack of...

CVE-2024-23826: Allocation of Resources Without Limits or Throttling

spbusesite is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an avatar image, an authenticated user may intentionally use a large Unicode filename which would lead to a server-side denial of service under Windows. This is...

The vulnerability of AVEVA PI Server’s data storage, normalization, analysis, and notification functions in real-time mode, due to incorrect handling of exceptional states, allows a perpetrator to trigger a service failure.

The vulnerability of the AVEVA PI Server’s data storage, normalization, analysis, and notification functions in real-time is related to improper handling of exceptional states. Exploiting this vulnerability could allow an attacker to cause service failures...

Improper Unicode Encoding

github.com/ewen-lbh/ffcss is vulnerable to Improper Handling Of Unicode Encoding. The vulnerability arises due to the use of late Unicode normalization of type NFKD in the lookupPreprocess method. It is possible to bypass validation on this method by a specially crafted Unicode input...

ewen-lbh/ffcss Late-Unicode normalization vulnerability

Summary The function lookupPreprocess is meant to apply some transformations to a string by disabling characters in the regex - .. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex - .. go ...

GHSA-WPMX-564X-H2MH ewen-lbh/ffcss Late-Unicode normalization vulnerability

Summary The function lookupPreprocess is meant to apply some transformations to a string by disabling characters in the regex - .. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex - .. go ...

CVE-2023-52081

ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function lookupPreprocess is meant to apply some transformations to a string by disabling characters in the regex - .. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypa...

Input validation

ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function lookupPreprocess is meant to apply some transformations to a string by disabling characters in the regex - .. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypa...

CVE-2023-52081

ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function lookupPreprocess is meant to apply some transformations to a string by disabling characters in the regex - .. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypa...

CVE-2023-52081 ewen-lbh/ffcss late-Unicode normalization vulnerability

ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function lookupPreprocess is meant to apply some transformations to a string by disabling characters in the regex - .. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypa...

PT-2023-31913 · Ffcss · Ffcss

Name of the Vulnerable Software and Affected Versions: ffcss versions prior to 0.2.0 Description: The issue concerns a Late-Unicode normalization vulnerability in the lookupPreprocess function, which is used to search for themes loosely by ignoring certain characters. Due to the use of late Unico...

CVE-2023-52081: Improper Handling of Unicode Encoding

ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function lookupPreprocess is meant to apply some transformations to a string by disabling characters in the regex - .. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypa...