PT-2021-4284 · Eterm +4 · Eterm +4

Name of the Vulnerable Software and Affected Versions: rxvt-unicode version 9.22 rxvt version 2.7.10 mrxvt version 0.5.4 Eterm version 0.9.7 Description: The issue is related to improper handling of certain escape sequences, specifically ESC G Q, which can lead to code execution. This could...

CVE-2021-25743

kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events...

Buffalo WSR-2533DHPL2 and WSR-2533DHP3 are vulnerable to path traversal

The Buffalo WSR-2533DHPL2 and WSR-2533DHP3 are routers from Buffalo Japan.The Buffalo WSR-2533DHPL2 and WSR-2533DHP3 suffer from a path traversal vulnerability, which stems from an input validation error when the web interface handles directory traversal sequences, and can be exploited by attacke...

CVE-2021-0268

CVE-2021-0268 concerns Juniper Networks Junos OS J-Web, due to an Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Response Splitting). The weakness can cause buffer overflows or segment faults and, per sources, may enable cross-site scripting (XSS) and cookie manipulation, with th...

Directory traversal

There is a directory traversing vulnerability in the download page url of AquaNPlayer 2.0.0.92. The IP of the download page url is localhost and an attacker can traverse directories using "dot dot" sequences../../ to view host file on the system. This vulnerability can cause information leakage...

SUSE-SU-2021:1165-1 Security update for glibc

This update for glibc fixes the following issues: - CVE-2020-27618: Accept redundant shift sequences in IBM1364 bsc1178386 - CVE-2020-29562: Fix incorrect UCS4 inner loop bounds bsc1179694 - CVE-2020-29573: Harden printf against non-normal long double values bsc1179721 - Check vector support in...

OESA-2021-1091 xterm security update

The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals. Security Fixes: xterm before Patch 366 allows remote attackers to execute arbitrary code or cause a denial of service segmentation fault via a crafted UTF-8 combining...

Huawei EulerOS: Security Advisory for glibc (EulerOS-SA-2021-1676)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

nss: Handling of Netscape Certificate Sequences in CERT_DecodeCertPackage() may crash with a NULL deref leading to DoS

In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service...

SUSE-SU-2021:0653-1 Security update for glibc

This update for glibc fixes the following issues: - Fix buffer overrun in EUC-KR conversion module CVE-2019-25013, bsc1182117, BZ 24973 - x86: Harden printf against non-normal long double values CVE-2020-29573, bsc1179721, BZ 26649 - gconv: Fix assertion failure in ISO-2022-JP-3 module...

CVE-2020-27618

The iconv function in the GNU C Library aka glibc or libc6 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a deni...

GNU C Library security vulnerability

The GNU C Library glibc, libc6 is an open source, free C language compiler released under the LGPL license. A security vulnerability exists in the GNU C Library that originates when processing invalid multibyte input sequences IBM1364, IBM1371, IBM1388, IBM1390, IBM1399 encoding, which could lead...

USN-4747-1: GNU Screen vulnerability

Felix Weinmann discovered that GNU Screen incorrectly handled certain character sequences. A remote attacker could use this issue to cause GNU Screen to crash, resulting in a denial of service, or possibly execute arbitrary code...

USN-4747-1 screen vulnerability

Felix Weinmann discovered that GNU Screen incorrectly handled certain character sequences. A remote attacker could use this issue to cause GNU Screen to crash, resulting in a denial of service, or possibly execute arbitrary code...

CVE-2021-20354

IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 194883...

Opencast Access Control Error Vulnerability

Opencast is a live video support software for large-scale automated video capture, management and distribution from the Opencast organization. An Access Control Error vulnerability exists in Opencast. The vulnerability stems from allowing the distribution of interludes with strict access rules wi...

Roundcube Webmail < 1.4.11 XSS Vulnerability

Roundcube Webmail is prone to a cross-site scripting XSS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

DEBIAN-CVE-2021-26929

An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 where the HordeTextFilter library before 2.3.7 is used. The attacker can send a plain text e-mail message, with JavaScript encoded as a link or email that is mishandled by preProcess in Text2html.php, because bespoke us...

UBUNTU-CVE-2021-27135

xterm before Patch 366 allows remote attackers to execute arbitrary code or cause a denial of service segmentation fault via a crafted UTF-8 combining character sequence...

Cross-site Scripting (XSS)

roundcube is vulnerable to cross-site scripting XSS. The vulnerability exists through specific CSS token sequences during HTML email rendering which allows an attacker to inject and execute arbitrary javascript...