2269 matches found
Design/Logic Flaw
jadx is a set of command line and GUI tools for producing Java source code from Android Dex and Apk files. versions prior to 1.4.5 are subject to a Denial of Service when opening zip files with HTML sequences. This issue has been patched in version 1.4.5. There are no known workarounds...
PT-2022-24851 · Jadx · Jadx
Name of the Vulnerable Software and Affected Versions: jadx versions prior to 1.4.5 Description: The issue concerns a Denial of Service that occurs when opening zip files containing HTML sequences. This can cause the interface to get stuck and throw exceptions. The problem arises when using...
USN-5659-1: kitty vulnerabilities
Stephane Chauveau discovered that kitty incorrectly handled image filenames with special characters in error messages. A remote attacker could possibly use this to execute arbitrary commands. This issue only affected Ubuntu 20.04 LTS. CVE-2020-35605 Carter Sande discovered that kitty incorrectly...
USN-5659-1 kitty vulnerabilities
Stephane Chauveau discovered that kitty incorrectly handled image filenames with special characters in error messages. A remote attacker could possibly use this to execute arbitrary commands. This issue only affected Ubuntu 20.04 LTS. CVE-2020-35605 Carter Sande discovered that kitty incorrectly...
Kitty: Arbitrary Code Execution
Background Kitty is a fast, feature-rich, GPU-based terminal. Description Carter Sande discovered that maliciously constructed control sequences can cause Kitty to display a notification that, when clicked, can cause Kitty to execute arbitrary commands. Impact Kitty can produce notifications that...
Security Bulletin: Potential Security exposure in IBM HTTP Server CVE-2013-1862 PM87808
Abstract Potential Security exposure in IBM HTTP Server for WebSphere Application Server Content VULNERABILITY DETAILS: CVE ID:CVE-2013-1862 DESCRIPTION: IBM HTTP Server optional modrewrite module does not properly filter terminal escape sequences from logs, which could make it easier for a remot...
GLSA-202209-07 : Mrxvt: Arbitrary Code Execution
The remote host is affected by the vulnerability described in GLSA-202209-07 Mrxvt: Arbitrary Code Execution - rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow potentially remote code execution because of improper handling of certain escape sequences ESC G Q. A response is...
nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes
A regular expression denial of service ReDoS vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes...
Archive_Tar: directory traversal due to inadequate checking of symbolic links
A flaw was found in the ArchiveTar package. ArchiveTar could allow a remote attacker to traverse directories on the system caused by inadequate checking of symbolic links. An attacker could send a specially-crafted URL request to the Tar.php script containing "dot dot" sequences /../ to modify...
CLSA-2022-1660762248 Fixed 13 CVEs in expat
CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs - CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution - CVE-2022-25315: Fix integer overflow in storeRawNames - CVE-2022-22822: Fix integer overflow in addBinding -...
[SECURITY] Fedora 36 Update: golang-github-mattn-colorable-0.1.8-8.fc36
Colorable writer for windows. For example, most of logger packages doesn't show colors on windows. This package is possible to handle escape sequence for ansi color on windows...
[SECURITY] Fedora 36 Update: golang-github-lunixbochs-vtclean-1.0.0-9.fc36
Clean up raw terminal output by stripping escape sequences, optionally preserving color...
[SECURITY] Fedora 36 Update: golang-github-aryann-difflib-0-0.6.20200822gite206f87.fc36
difflib is a simple library written in Go for diffing two sequences of text...
SUSE-SU-2022:2526-1 Security update for rubygem-rack
This update for rubygem-rack fixes the following issues: - CVE-2022-30122: Fixed crafted multipart POST request may cause a DoS bsc1200748 - CVE-2022-30123: Fixed crafted requests can cause shell escape sequences bsc1200750 The following non-security bug was fixed: - Fixed a regression in...
[SECURITY] Fedora 35 Update: golang-github-lunixbochs-vtclean-1.0.0-8.fc35
Clean up raw terminal output by stripping escape sequences, optionally preserving color...
CVE-2022-31150
undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this...
Fedora: Security Advisory for golang-github-aryann-difflib (FEDORA-2022-3969b64d4b)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
[SECURITY] Fedora 36 Update: golang-github-lunixbochs-vtclean-1.0.0-8.fc36
Clean up raw terminal output by stripping escape sequences, optionally preserving color...
The vulnerability of the ManagedIT.asmx component of the ConnectWise ManagedITSync plugin in the Kaseya VSA IT-infrastructure management platform allows a attacker to execute arbitrary SQL commands.
The vulnerability of the ManagedIT.asmx component of the ConnectWise ManagedITSync business management platform is related to the lack of validation for the validity of XML objects’ sequences. Exploiting this vulnerability could allow a malicious actor to execute arbitrary SQL commands through th...
