Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The cross-site scripting XSS prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a...

FreeBSD : irssi -- multiple vulnerabilities (85e2c7eb-b74b-11e7-8546-5cf3fcfdd1f1)

Irssi reports : When installing themes with unterminated colour formatting sequences, Irssi may access data beyond the end of the string. While waiting for the channel synchronisation, Irssi may incorrectly fail to remove destroyed channels from the query list, resulting in use after free...

Irssi String Over-Reading Vulnerability

Irssi is an IRC client program with a text user interface, released under the GPL. A security vulnerability exists in versions of Irssi prior to 1.0.5, which stems from the program failing to detect if the length of a Safe channel ID is long enough. A remote attacker could use this vulnerability ...

CVE-2017-15722

In certain cases, Irssi before 1.0.5 may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string...

ALPINE-CVE-2017-15722

In certain cases, Irssi before 1.0.5 may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string...

Spoofing

In certain cases, Irssi before 1.0.5 may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string...

CVE-2017-15722

In certain cases, Irssi before 1.0.5 may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string...

CVE-2017-15722

In certain cases, Irssi before 1.0.5 may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string...

CVE-2017-15722

CVE-2017-15722 affects Irssi prior to 1.0.5, where a failure to verify that a Safe channel ID is long enough can cause reads beyond the end of the string. Connected advisories confirm Irssi

CVE-2017-15722

In certain cases, Irssi before 1.0.5 may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string...

UBUNTU-CVE-2017-15722

In certain cases, Irssi before 1.0.5 may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string...

DEBIAN-CVE-2017-8805

Debian ftpsync before 20171017 does not use the rsync --safe-links option, which allows remote attackers to conduct directory traversal attacks via a crafted upstream mirror...

UBUNTU-CVE-2017-8805

Debian ftpsync before 20171017 does not use the rsync --safe-links option, which allows remote attackers to conduct directory traversal attacks via a crafted upstream mirror...

UBUNTU-CVE-2017-12629

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML extern...

mysql: unrestricted mysqld_safe's ledir (CPU Jan 2017)

It was discovered that the mysqldsafe script honored the ledir option value set in a MySQL configuration file. A user able to modify one of the MySQL configuration files could use this flaw to escalate their privileges to root...

mysql: insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664 fix (CPU Jan 2017)

Multiple flaws were found in the way the mysqldsafe script handled creation of error log file. The mysql operating system user could use these flaws to escalate their privileges to root...

irssi -- multiple vulnerabilities

Irssi reports: When installing themes with unterminated colour formatting sequences, Irssi may access data beyond the end of the string. While waiting for the channel synchronisation, Irssi may incorrectly fail to remove destroyed channels from the query list, resulting in use after free conditio...

The vulnerability of Kaspersky Safe Browser’s antivirus protection lies in the lack of protection for service data, which allows attackers to obtain confidential information.

The vulnerability of Kaspersky Safe Browser lies in the lack of protection for service data. Exploiting this vulnerability allows a malicious actor, operating remotely, to obtain confidential information using a specially crafted certificate. The problem is that Kaspersky Safe Browser does not...

PT-2017-6156 · Red Hat · Red Hat Enterprise Virtualization +1

Name of the Vulnerable Software and Affected Versions: ovirt-node version 3.0.0-474-gb852fd7 as packaged in Red Hat Enterprise Virtualization 3 Description: The issue arises from the ovirt safe delete config function in ovirtfunctions.py and other unspecified locations, which fails to properly...

mysql: insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664 fix (CPU Jan 2017)

Multiple flaws were found in the way the mysqldsafe script handled creation of error log file. The mysql operating system user could use these flaws to escalate their privileges to root...