CVE-2025-22387: Use of GET Request Method With Sensitive Query Strings

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be leveraged for session hijacking...

CVE-2024-9427

Koji contains an XSS vulnerability (CVE-2024-9427) due to unsanitized input that can reflect JavaScript from a malicious link in the web page. The description notes that existing XSS protections in the code are expected to prevent submitting actions or changes. The connected sources confirm this ...

CVE-2024-9427 Koji: escape html tag characters in the query string

A vulnerability in Koji was found. An unsanitized input allows for an XSS attack. Javascript code from a malicious link could be reflected in the resulting web page. It is not expected to be able to submit an action or make a change in Koji due to existing XSS protections in the code...

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

...

virtualenv: potential command injection via virtual environment activation scripts

A flaw was found in the virtualenv Python package. Due to the improper handling of quotes in magic template strings, the virtual environment activation script is vulnerable to OS command injection,leading to the loss of confidentiality,integrity and availability of the system...

virtualenv: potential command injection via virtual environment activation scripts

A flaw was found in the virtualenv Python package. Due to the improper handling of quotes in magic template strings, the virtual environment activation script is vulnerable to OS command injection,leading to the loss of confidentiality,integrity and availability of the system...

Fedora 41 : python3.9 (2024-47e4624c89)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-47e4624c89 advisory. Python 3.9.21 security release. Security content in this release -------------------------------- - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to...

Malware in plugin-proposal-json-strings

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

PT-2024-41090 · Git +1 · Shaderc

Name of the Vulnerable Software and Affected Versions: glslang affected versions not specified Description: The software contains a heap-buffer-overflow read issue. The crash occurs during the parseShaderStrings function within the glslang::HlslParseContext. This function is called by...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an undefined behavior issue in the vdpa driver due to strings being allocated on the stack, as these strings...

Cisco IP Phone 7920 SNMP Information Disclosure (CVE-2005-3803)

Cisco IP Phone VoIP 7920 1.08 contains certain hard-coded fixed public and private SNMP community strings that cannot be changed, which allows remote attackers to obtain sensitive information. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for mor...

SUSE CVE-2024-42330

The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that...

PT-2024-9092

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The issue is related to the use of uncontrolled format strings when processing HttpRequest objects, which can allow a remote attacker to gain unauthorized access to protected information. Th...

SUSE CVE-2024-53899

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an incorrect call to the BPFLINKTYPE macro to register a link type, which can lead to out-of-bounds access...

GHSA-RQC4-2HC7-8C8V virtualenv allows command injection through activation scripts for a virtual environment

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287...

PYSEC-2024-187

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287...

AZL-53645 CVE-2024-53899 affecting package python-virtualenv for versions less than 20.26.6-1

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287...

PYSEC-2024-187

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287...

UBUNTU-CVE-2024-53899

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287...