MediaWiki Cross-Site Request Forgery Vulnerability (CNVD-2021-07548)

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. It can be used to deploy in-house knowledge management and content management systems. MediaWiki suffers from a cross-site request forgery vulnerability that stems from not having protection...

Input validation

Philips Interventional Workspot Release 1.3.2, 1.4.0, 1.4.1, 1.4.3, 1.4.5, Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live Release 1.0, ViewForum Release 6.3V1L10. The software constructs all or part of an OS command using externally influenced input from an upstream component but does no...

Important: sudo

Issue Overview: When sudo runs a command in shell mode, either via the -s or -i command line option, it escapes special characters in the command's arguments with a backslash. The sudoers policy plugin will then remove the escape characters from the arguments before evaluating the sudoers policy...

Important: sudo

Issue Overview: When sudo runs a command in shell mode, either via the -s or -i command line option, it escapes special characters in the command's arguments with a backslash. The sudoers policy plugin will then remove the escape characters from the arguments before evaluating the sudoers policy...

Red Hat Undertow 资源管理错误漏洞

Red Hat Undertow is a U.S. Red Hat Red Hat, a Java-based embedded Web server, is the default Web server Wildfly Java application server. Red Hat Undertow suffers from a denial of service vulnerability that originates from an input validation error to a user, which can be exploited by an attacker ...

MediaWiki 跨站请求伪造漏洞

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. It can be used to deploy in-house knowledge management and content management systems. MediaWiki suffers from a cross-site request forgery vulnerability that stems from not having protection...

Cross site scripting

Hyweb HyCMS-J1 backend editing function does not filter special characters. Users after log-in can inject JavaScript syntax to perform a stored XSS Stored Cross-site scripting attack...

The vulnerability of NETGEAR’s embedded software exists due to the lack of measures taken to neutralize special elements used in the operating system commands. This allows a hacker to execute arbitrary commands.

The vulnerability in NETGEAR’s embedded software exists because measures are not taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Huawei EMUI Input Validation Denial of Service Vulnerability

Huawei Emui is an Android-based mobile operating system developed by Huawei of China. Huawei EMUI suffers from an input validation vulnerability, which can be exploited by remote attackers to submit special requests for out-of-bounds access and conduct denial-of-service attacks...

CVE-2021-21248

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job paramete...

I Am Not a Soldier, but I Have Been Trained to Kill

A sprawling tactical industry is teaching American civilians how to fight like Special Ops forces. By preparing for violence at home, are they calling it into being?...

The vulnerability in the implementation of the Strict Transport Security (HSTS) mechanism of the Mozilla Firefox browser allows a perpetrator to compromise the integrity of data.

The vulnerability of the Strict Transport Security HSTS mechanism implemented by Mozilla Firefox is related to incorrect elimination of special elements in the output data used by the incoming component. Exploiting this vulnerability can allow a remote attacker to compromise the integrity of the...

OPENSUSE-SU-2021:0025-1 Security update for kitty

This update for kitty fixes the following issue: - CVE-2020-35605: Fixed an RCE due to filenames containing special characters contained in error messages boo1180298...

Security update for kitty (important)

openSUSE Security Update: Security update for kitty Announcement ID: openSUSE-SU-2021:0025-1 Rating: important References: 1180298 Cross-References: CVE-2020-35605 Affected Products: openSUSE Leap 15.2 An update that fixes one vulnerability is now available. Description: This update for kitty fix...

CVE-2020-35769

miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program...

CVE-2020-35769

miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program...

FreeBSD : Intel CPU issues (fbcba194-ac7d-11ea-8b5e-b42e99a1b9c3)

Intel reports : Intel CPUs suffer Special Register Buffer Data Sampling vulnerability C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and contributors Redistribution and us...

The vulnerability of the IBM Cloud Pak for Security (CP4S) platform, related to the lack of measures to neutralize special elements, allows a hacker to execute arbitrary code.

The vulnerability of the IBM Cloud Pak for Security CP4S platform is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability may allow a malicious actor to execute arbitrary code remotely...

Remote Code Execution (RCE)

kitty is vulnerable to remote code execution. The vulnerability is possible because filename containing special characters can be included in an error message which allows an attacker to inject malicious code into the system...

CVE-2020-24679 Denial of Service attack on Symphony Plus

A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this flaw to make it crash or even execute arbitrary code on the machine where the service is hosted...