Security Bulletin: IBM® Db2® is affected by multiple vulnerabilities in the included Expat 3rd party library (CVE-2022-23852 and CVE-2022-23990)

Summary IBM® Db2® is affected by multiple vulnerabilities in the included Expat 3rd party library. This fix provides an upgrade to the Expat library. Vulnerability Details CVEID: CVE-2022-23852 DESCRIPTION: Expat aka libexpat could allow a remote attacker to execute arbitrary code on the system,...

The vulnerability of the load_cache function in the GIMP graphic editor allows a hacker to transfer special application data and execute arbitrary OS commands on the target system.

The vulnerability of the loadcache function in the GIMP graphic editor exists because measures to neutralize the special elements used in the operating system command are not taken. Exploiting this vulnerability allows a malicious actor to transmit special application data and execute arbitrary O...

Elcomplus SmartPPT 路径遍历漏洞

Elcomplus SmartPPT is an integrated voice and data scheduling software from Elcomplus USA. A path traversal vulnerability exists in Elcomplus SmartPPT that stems from the software using external input to construct a pathname that should be located in a restricted directory, but it fails to...

special.visitkronshtadt.ru Cross Site Scripting vulnerability OBB-2508988

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-27384

An issue in the component Itemsubselect::initexprcachetracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service DoS via specially crafted SQL statements...

Tukaani XZ Utils xzgrep Argument Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tukaani XZ Utils. Interaction with this script is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of...

CVE-2022-24832 Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames

GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it ca...

Google Android Elevation of Privilege Vulnerability (CNVD-2022-28910)

Google Android is a Linux-based open-source operating system from the US company Google. Google Android has security vulnerabilities that can be exploited by attackers to submit special requests that can execute arbitrary code in the application context and elevate privileges...

CVE-2021-43517

FOSCAM Camera FI9805E with firmware V4.02.R12.00018510.10012.143900.00000 contains a backdoor that opens Telnet port when special command is sent on port 9530...

Input validation

FOSCAM Camera FI9805E with firmware V4.02.R12.00018510.10012.143900.00000 contains a backdoor that opens Telnet port when special command is sent on port 9530...

CVE-2022-26675

aEnrich a+HRD has inadequate filtering for special characters in URLs. An unauthenticated remote attacker can bypass authentication and perform path traversal attacks to access arbitrary files under website root directory...

CVE-2022-23971

ASUS RT-AX56U’s updatePLC/PORT file has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated LAN attacker can overwrite a system file by uploading another PLC/PORT file with the same file name, which results in service...

Path traversal

ASUS RT-AX56U’s updatejson function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated LAN attacker can overwrite a system file by uploading another file with the same file name, which results in service disruption...

CVE-2022-26670

CVE-2022-26670 concerns the D-Link DIR-878 wireless router. The vulnerability stems from inadequate filtering for special characters in a webpage input field, enabling an unauthenticated LAN attacker to perform a command injection and execute arbitrary system commands. The available connected sou...

The vulnerability of the CGI microprogramming system handlers of ZyXEL NBG6816 (Armor Z1) and NBG6817 (Armor Z2) allows a hacker to execute arbitrary commands.

The vulnerability of CGI microprogramming system processors in Wi-Fi routers from ZyXEL NBG6816 Armor Z1 and NBG6817 Armor Z2 lies in the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow attackers to execute...

Cross-site Scripting (XSS)

uri.js is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization of \r CR, \n, LF \t TAB of the URI allowing an attacker to inject maliciously crafted script into the system...

MediaWiki 输入验证错误漏洞

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. MediaWiki suffers from an input validation error vulnerability that stems from insufficient...

CVE-2021-38834

easy-mock v1.5.0-v1.6.0 allows remote attackers to bypass the vm2 sandbox and execute arbitrary system commands through special js code...

The vulnerability of the `line_table::line_table` function in the ELF and DWARFv4 reading library Libelfin allows a attacker to cause a service failure.

The vulnerability of the linetable::linetable function in the ELF and DWARFv4 reading library Libelfin is related to insufficient elimination of special elements in the request. Exploiting this vulnerability allows a malicious actor to trigger a service failure using a specially created ELF file...

The vulnerability of the XML DOM implementation lies in the lack of mechanisms for encoding or escaping output data, allowing attackers to compromise the integrity of the data.

The vulnerability of the XML DOM implementation is related to improper filtering of special characters. Exploiting this vulnerability allows an attacker to compromise data integrity remotely...