25617 matches found
GeoServer SQL injection vulnerability
GeoServer is an open source software server written in Java. It allows users to share and edit geospatial data. A security vulnerability exists in GeoServer versions prior to 2.21.4, 2.22.2 and 2.22.2, which stems from abuse of strEndsWith, strStartsWith and PropertyIsLike...
CVE-2022-48338
An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called throug...
CVE-2023-25656
notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users will find their application using excessive memory when verifying signatures. The application will be killed, and thus availability is...
Design/Logic Flaw
notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users will find their application using excessive memory when verifying signatures. The application will be killed, and thus availability is...
PT-2023-9293
Name of the Vulnerable Software and Affected Versions GNU Emacs versions through 28.2 Description An issue was discovered in GNU Emacs where the ruby-find-library-file function in ruby-mode.el has a local command injection vulnerability. The ruby-find-library-file function is an interactive...
CVE-2022-48338
An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called throug...
CVE-2023-25656 notation-go has excessive memory allocation on verification
notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users will find their application using excessive memory when verifying signatures. The application will be killed, and thus availability is...
CVE-2022-48338: Improper Neutralization of Special Elements used in a Command
An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called throug...
CVE-2021-32848: Allocation of Resources Without Limits or Throttling
Octobox is software for managing GitHub notifications. Prior to pull request PR 2807, a user of the system can provide a specifically crafted search query string that will trigger a ReDoS vulnerability. This issue is fixed in PR 2807...
CVE-2023-23783
A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted command arguments...
CVE-2023-23783
CVE-2023-23783 relates to Fortinet FortiWeb, where a vulnerability stems from an externally-controlled format string in the command line interface. Affected products include FortiWeb 7.0.0–7.0.1 and FortiWeb 6.4 (all versions). The root cause is improper handling of format strings, which could al...
Fortinet FortiWeb formatted string error vulnerability
Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A formatted string error vulnerability exist...
CVE-2023-23783: Use of Externally-Controlled Format String
A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted command arguments...
Format string vulnerability in the CLI
A format string vulnerability CWE-134 in the command line interpreter of FortiWeb may allow an authenticated user to execute unauthorized code or commands via specially crafted command arguments...
PT-2023-3049
Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.4.0 through 7.0.1 FortiWeb version 7.0.0 through 7.0.1 Description The issue is related to a use of externally-controlled format string in FortiWeb, allowing an attacker to execute unauthorized code or commands via speciall...
SUSE CVE-2000-0573
The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitrary commands via the SITE EXEC command...
SUSE CVE-2000-0666
rpc.statd in the nfs-utils package in various Linux distributions does not properly cleanse untrusted format strings, which allows remote attackers to gain root privileges...
SUSE CVE-2002-1215
Multiple format string vulnerabilities in heartbeat 0.4.9 and earlier claimed as buffer overflows in some sources allow remote attackers to execute arbitrary code via certain packets to UDP port 694 incorrectly claimed as TCP in some sources...