Home Assistant 安全漏洞

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in Home Assistant Community Add-on: SSH & Web Terminal versions prior to 10.0.0. There is no information about this vulnerability at...

Diagnostic data to collect for Citrix Tech Support when a Citrix Browser App fails to launch

To find out what is going wrong when a Citrix browser app fails to launch, tech support needs: Decrypted Fiddler traces, the output from the terminal window, and Citrix Browser debug logs...

The vulnerability of the Yarus C2100 payment terminal software allows a perpetrator to execute arbitrary code on the device with privileges as a non-privileged POS user.

The vulnerability of the Yarus C2100 payment terminal software lies in the possibility of buffer overflows during the processing of update files. Exploiting this vulnerability allows a malicious actor to recompile program objects, alter the program’s execution flow, and execute their own code tha...

The vulnerability of the Yarus C2100 payment terminal software allows a perpetrator to execute arbitrary code with root privileges of the operating system.

The vulnerability of the Yarus C2100 payment terminal software relates to the possibility of a memory overflow in the kernel’s static memory when working with smart cards. Exploiting this vulnerability can allow an attacker to execute arbitrary code with root privileges on the operating system...

OESA-2021-1453 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple times, creating semaphores. This flaw allows a local user to starve th...

Hitachi Energy RTU500 OpenLDAP

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: RTU500 Series Vulnerabilities: Type Confusion, Reachable Assertion 2. RISK EVALUATION Successful exploitation of these vulnerabilities could cause a denial-of-service condition...

[SECURITY] Fedora 34 Update: chafa-1.2.1-6.fc34

Chafa is a command-line utility that converts all kinds of images, including animated image formats like GIFs, into ANSI/Unicode character output that can be displayed in a terminal. It is highly configurable, with support for alpha transparency and multiple color modes and color spaces, combinin...

Schneider Electric SESU

1. EXECUTIVE SUMMARY CVSS v3 3.8 ATTENTION: Low attack complexity Vendor: Schneider Electric Equipment: Schneider Electric Software Update SESU Vulnerability: Insufficient Entropy 2. RISK EVALUATION Successful exploitation of this vulnerability could cause unintended connection from an internal...

CVE-2021-3769

Vulnerability in pygmalion, pygmalion-virtualenv and refined themes Description: these themes use print -P on user-supplied strings to print them to the terminal. All of them do that on git information, particularly the branch name, so if the branch has a specially-crafted name the vulnerability...

CVE-2021-3726

Vulnerability in title function Description: the title function defined in lib/termsupport.zsh uses print to set the terminal title to a user-supplied string. In Oh My Zsh, this function is always used securely, but custom user code could use the title function in a way that is unsafe. Fixed in:...

Format string

Vulnerability in title function Description: the title function defined in lib/termsupport.zsh uses print to set the terminal title to a user-supplied string. In Oh My Zsh, this function is always used securely, but custom user code could use the title function in a way that is unsafe. Fixed in:...

CVE-2021-3769

The CVE-2021-3769 entry concerns ohmyzsh themes pygmalion, pygmalion-virtualenv, and refined, which print user-supplied strings with print -P to the terminal. The branch name can be crafted to trigger code execution, per the description. The issue was fixed in commit b3ba9978 (ohmyzsh/ohmyzsh). A...

CVE-2021-3726

This CVE affects Oh My Zsh: the vulnerable component is the title function in lib/termsupport.zsh, which uses print to set the terminal title from a user-supplied string. The root cause is unsafe handling of a user-provided value within this function, potentially enabling a vulnerability through ...

PT-2021-21593

Name of the Vulnerable Software and Affected Versions Oh My Zsh versions prior to the version that includes commit a263cdac Description The issue arises from the title function defined in lib/termsupport.zsh, which uses print to set the terminal title to a user-supplied string. Although Oh My Zsh...

ohmyzsh 操作系统命令注入漏洞

ohmyzsh is an open source, community-driven framework for managing your zsh configuration. An operating system command injection vulnerability exists in ohmyzsh, which stems from the "title" function defined in "lib/termsupport.zsh" that uses "print" to set the terminal title to a user-supplied...

Fedora: Security Advisory for et (FEDORA-2021-532fcdde8a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 34 Update: et-6.1.9-1.fc34

Eternal Terminal ET is a remote shell that automatically reconnects without interrupting the session...

[SECURITY] Fedora 35 Update: et-6.1.9-1.fc35

Eternal Terminal ET is a remote shell that automatically reconnects without interrupting the session...

USN-5137-2: Linux kernel vulnerabilities

It was discovered that the f2fs file system in the Linux kernel did not properly validate metadata in some situations. An attacker could use this to construct a malicious f2fs image that, when mounted and operated on, could cause a denial of service system crash or possibly execute arbitrary code...

kernel: locking inconsistency in drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c can lead to a read-after-free

A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel. A local user could use this flaw to read numerical value from memory after free...