490 matches found
SUSE CVE-2014-9651
Buffer overflow in CHICKEN 4.9.0.x before 4.9.0.2, 4.9.x before 4.9.1, and before 5.0 allows attackers to have unspecified impact via a positive START argument to the "substring-index-ci procedures."...
SUSE CVE-2015-8392
PCRE before 8.38 mishandles certain instances of the ?| substring, which allows remote attackers to cause a denial of service unintended recursion and buffer overflow or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object...
SUSE CVE-2015-9096
Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring...
SUSE CVE-2017-7246
Stack-based buffer overflow in the pcre32copysubstring function in pcreget.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service WRITE of size 268 or possibly have unspecified other impact via a crafted file...
SUSE CVE-2017-7245
Stack-based buffer overflow in the pcre32copysubstring function in pcreget.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service WRITE of size 4 or possibly have unspecified other impact via a crafted file...
SUSE CVE-2018-13259
An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one...
SUSE CVE-2020-14155
libpcre in PCRE before 8.44 allows an integer overflow via a large number after a ?C substring...
CVE-2022-37706
enlightenmentsys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring...
CVE-2022-37706
enlightenmentsys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring...
CVE-2022-2720
In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value masking will only partially work...
Octopus Server security vulnerabilities
Octopus Server is an automated deployment platform. A security vulnerability exists in Octopus Server that stems from the fact that sensitive value masking will only partially work when the sensitive value is a substring of another value in the affected Octopus Server The following products and...
CVE-2022-40317
OpenKM 6.3.11 allows stored XSS related to the javascript substring in an A element...
CVE-2022-40317
OpenKM 6.3.11 allows stored XSS related to the javascript substring in an A element...
Cross site scripting
OpenKM 6.3.11 allows stored XSS related to the javascript substring in an A element...
CVE-2022-40317
OpenKM 6.3.11 allows stored XSS related to the javascript substring in an A element...
CVE-2022-40317
OpenKM 6.3.11 allows stored XSS related to the javascript substring in an A element...
PT-2022-25345 · Openkm · Openkm
Name of the Vulnerable Software and Affected Versions: OpenKM version 6.3.11 Description: The issue allows stored XSS related to the javascript: substring in an A element. This could potentially lead to malicious script execution when a user interacts with the affected element. Recommendations: F...
CVE-2022-38794
Zaver through 2020-12-15 allows directory traversal via the GET /.. substring...
Zaver path traversal vulnerability
Zaver is a fast and efficient HTTP server for individual developers. A security vulnerability exists in Zaver version 2020-12-15 and earlier that stems from allowing directory traversal via substrings...
GHSA-2M9R-PM7Q-WR6F GeniXCMS denial of service (account blockage)
GeniXCMS before 1.1.0 allows remote attackers to cause a denial of service account blockage by leveraging the mishandling of certain username substring relationships, such as the admin username versus the admin username, related to register.php, User.class.php, and Type.class.php...