NASK PIB BotSense 安全漏洞

NASK PIB BotSense is a financial sector protection system from NASK. A security vulnerability exists in NASK PIB BotSense versions prior to 2.8.0, which stems from a string encoding error that could result in the injection of additional field separators in some fields of a generated event...

TeamViewer 安全漏洞

TeamViewer is software from TeamViewer, Inc. for remote access as well as remote control and remote maintenance of computers and other end devices. A security vulnerability exists in TeamViewer versions prior to 15.62 that stems from an incorrect neutralization of parameter separators in the...

PT-2024-36790

Name of the Vulnerable Software and Affected Versions pyrage versions 1.2.0 through 1.2.2 Description The issue concerns the execution of arbitrary binaries due to malicious plugin names, recipients, or identities. This can occur when a plugin name containing a path separator is provided to the a...

Laravel register_argc_argv Data Compromise

The vulnerability in the registerargcargv configuration in the Laravel PHP framework is related to the improper elimination of arguments separators in the command. Exploiting this vulnerability allows an attacker to compromise the integrity of the protected information from a remote location...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data v4.8.6 is vulnerable to multiple Operator package issues

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data v4.8.6 is vulnerable to multiple Operator package issues. We have performed updates to the Operators used by our Speech Services. The following vulnerabilities have been addressed in this update. Please read the details for...

CVE-2024-6759

When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, "/". This allows readdir3 and related functions to return filesystem entries with names containing additional path components. The lack of validation described...

CVE-2024-6759 NFS client accepts file names containing path separators

When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, "/". This allows readdir3 and related functions to return filesystem entries with names containing additional path components. The lack of validation described...

CVE-2024-6759

The CVE-2024-6759 issue affects FreeBSD NFS client behavior: the kernel does not sanitize remotely provided filenames containing the path separator "/" when mounting a remote filesystem, allowing readdir(3) and related calls to return entries with extra path components. This creates a confused de...

CVE-2024-6759 NFS client accepts file names containing path separators

When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, "/". This allows readdir3 and related functions to return filesystem entries with names containing additional path components. The lack of validation described...

FreeBSD -- NFS client accepts file names containing path separators

Problem Description: When mounting a remote filesystem using NFS, the kernel did not sanitize remotely provided filenames for the path separator character, "/". This allows readdir3 and related functions to return filesystem entries with names containing additional path components. Impact: The la...

Nomad Go-getter Orchestrator Command Injection

The vulnerability of the Nomad application’s Go-getter orchestrator library relates to the improper elimination of argument separators in commands. Exploiting this vulnerability allows a malicious actor to format the Git URL remotely, thereby introducing additional Git arguments during the Git...

PT-2024-11560

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue arises from the use of path.Base to extract the expected HTTP-01 token value, which behaves differently on Windows due to the distinct path...

Traversal outside working tree enables arbitrary code execution

Summary During checkout, gitoxide does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. Details Although gix-worktree-state checks for collisions with existing files, it does not...

RHEL 7 : python-pip (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - python-pip: when --extra-index-url option is used and package does not already exist in the public index,...

Oracle Linux 9 : runc (ELSA-2024-2180)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-2180 advisory. 4:1.1.12-2 - Switch dependency on criu to Recommends - Resolves: RHEL-25116 Tenable has extracted the preceding description block directly from the...

golang: io/fs: stack exhaustion in Glob

A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability...

igraph:vertex_separators: Heap-buffer-overflow in igraph_cohesive_blocks

Project: https://github.com/igraph/igraph.git Detailed Report: https://oss-fuzz.com/testcase?key=5213632730300416 Project: igraph Fuzzing Engine: libFuzzer Fuzz Target: vertexseparators Job Type: libfuzzerasanigraph Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

BIT-PIP-2021-3572

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1...

BIT-GOLANG-2022-30630 Stack exhaustion in Glob on certain paths in io/fs

Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators...

BIT-GOLANG-2022-30632 Stack exhaustion on crafted paths in path/filepath

Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators...