2268 matches found
PT-2024-14628 · Openbsd · Openbsd
Name of the Vulnerable Software and Affected Versions: OpenBSD versions 7.3 through 7.4 before errata 019 and 002 respectively OpenBSD version 7.3 before errata 019 OpenBSD version 7.4 before errata 002 Description: A network buffer issue exists where a buffer that had to be split at a certain...
GHSA-VR64-R9QJ-H27F Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service
Any program on the JVM may read serialized objects via java.io.ObjectInputStream.readObject. Reading serialized objects from an untrusted source is inherently unsafe this affects any program running on any version of the JVM and is a prerequisite for this vulnerability. Clojure classes that...
CentOS 9 : less-590-2.el9
The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the less-590-2.el9 build changelog. - In GNU Less before 609, crafted data can result in less -R not filtering ANSI escape sequences sent to the terminal. CVE-2022-46663 Note that Nessus ha...
IBM QRadar SOAR Plug-in 路径遍历漏洞
The IBM SOAR QRadar Plugin is a tool from International Business Machines IBM used to provide bi-directional messaging between IBM Security QRadar SIEM and QRadar SOAR. The IBM SOAR QRadar Plugin App suffers from a directory traversal vulnerability that could be exploited by an attacker to send a...
Path Traversal
kodi is vulnerable to Path Traversal. The vulnerability is due to there is no sanitization on user-provided input and allowing special character sequences like encoded dot-dot-slash. This allows remote attackers to access and read arbitrary files on the system by exploiting encoded sequences in t...
CVE-2023-35020
IBM Sterling Control Center 6.3.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 257874...
AZL-38425 CVE-2023-45236 affecting package edk2 for versions less than 20240223gitedc6681206c1-1
EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality...
SUSE SLES12 Security Update : libssh2_org (SUSE-SU-2023:4946-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4946-1 advisory. - CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity Terrapin Attack bsc1218127. Tenable has extracted the preceding...
CVE-2023-47702
IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view modify files on the system. IBM X-Force ID: 271196...
CVE-2023-47702 IBM Security Guardium Key Lifecycle Manager directory traversal
IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view modify files on the system. IBM X-Force ID: 271196...
USN-6233-2 yajl vulnerabilities
USN-6233-1 fixed vulnerabilities in YAJL. This update provides the corresponding updates for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. Original advisory details: It was discovered that YAJL was not properly performing bounds checks when decoding a string with escape sequences. If a us...
PT-2023-7977 · Freebsd · Freebsd
Name of the Vulnerable Software and Affected Versions: FreeBSD versions 12.4-RELEASE through 12.4-RELEASE-p8 FreeBSD versions 13.2-RELEASE through 13.2-RELEASE-p6 FreeBSD versions 14.0-RELEASE through 14.0-RELEASE-p1 Description: The pf4 packet filter in FreeBSD incorrectly validates TCP sequence...
The vulnerability of the aiohttp HTTP client, related to the failure to handle CRLF sequences for line termination, allows attackers to send hidden HTTP requests (HTTP Request Smuggling attack).
The vulnerability of the aiohttp HTTP client is related to the lack of measures taken to neutralize CRLF sequences. Exploiting this vulnerability allows an attacker, operating remotely, to send hidden HTTP requests HTTP Request Smuggling attack...
Rocky Linux 8 : binutils (RLSA-2021:4595)
The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:4595 advisory. - DISPUTED An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via...
SUSE CVE-2015-5190
The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL...
CVE-2023-46300
iTerm2 before 3.4.20 allow potentially remote code execution because of mishandling of certain escape sequences related to tmux integration...
CVE-2023-46301
iTerm2 before 3.4.20 allow potentially remote code execution because of mishandling of certain escape sequences related to upload...
CVE-2023-46300
iTerm2 before 3.4.20 allow potentially remote code execution because of mishandling of certain escape sequences related to tmux integration...
