22 matches found
CVE-2026-71802
A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...
AZL-99986 CVE-2026-19843 affecting package 389-ds-base 3.1.1-12
A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name DN into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft ...
CVE-2026-84642
The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 15...
CVE-2026-55618
emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, the cleanfounduri function in emlparser/parser.py validates potential URL strings before unescaping HTML entities used for colon, slash,...
AZL-86799 CVE-2026-27851 affecting package dovecot 2.3.20-1
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks when used in authentication. Avoid using safe filter until on fixed version. No...
CVE-2026-1395
The Gutentools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Slider block's blockid attribute in all versions up to, and including, 1.1.3. This is due to insufficient input sanitization and output escaping combined with a custom unescaping routine that reintroduce...
MiracleLinux 4 : glibc-2.12-1.212.AXS4 (AXSA:2018-3156:01)
The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3156:01 advisory. glibc: Buffer overflow in glob with GLOBTILDE CVE-2017-15670 glibc: Buffer overflow during unescaping of user names with the operator CVE-2017-15804...
EUVD-2017-7227
Malware in sbrugna...
RCE-Foryou
RCE-Foryou Python tool for safely testing and exploiting RCE v...
CVE-2022-34172
In Jenkins 2.340 through 2.355 both inclusive symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting XSS vulnerability...
NewStart CGSL MAIN 4.05 : glibc Multiple Vulnerabilities (NS-SA-2019-0142)
The remote NewStart CGSL host, running version MAIN 4.05, has glibc packages installed that are affected by multiple vulnerabilities: - The GNU C Library aka glibc or libc6 before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to...
BSA-2018-616
Security Advisory ID : BSA-2018-616 Component : bzip2recover Revision : 2.0 The glob function in glob.c in the GNU C Library aka glibc or libc6 before 2.27 contains a buffer overflow during unescaping of user names with the operator. Affected Products Security update provided inBrocade Fabric OS...
curl: escape and unescape integer overflows
Multiple integer overflow flaws leading to heap-based buffer overflows were found in the way curl handled escaping and unescaping of data. An attacker could potentially use these flaws to crash an application using libcurl by sending a specially crafted input to the affected libcurl functions...
glibc: Buffer overflow during unescaping of user names with the ~ operator
The glob function in glob.c in the GNU C Library aka glibc or libc6 before 2.27 contains a buffer overflow during unescaping of user names with the operator...
glibc: Buffer overflow during unescaping of user names with the ~ operator
The glob function in glob.c in the GNU C Library aka glibc or libc6 before 2.27 contains a buffer overflow during unescaping of user names with the operator...
EulerOS 2.0 SP1 : glibc (EulerOS-SA-2017-1267)
According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The GNU C Library aka glibc or libc6 before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in...
DEBIAN-CVE-2017-15804
The glob function in glob.c in the GNU C Library aka glibc or libc6 before 2.27 contains a buffer overflow during unescaping of user names with the operator...
CVE-2017-15804
The glob function in glob.c in the GNU C Library aka glibc or libc6 before 2.27 contains a buffer overflow during unescaping of user names with the operator...
