6469 matches found
GHSA-G5VF-V6WF-7W2R Ciphertext Malleability Issue in Tink Java
Impact Tink's Java version before 1.5 under some circumstances allowed attackers to change the key ID part of the ciphertext, resulting in the attacker creating a second ciphertext that will decrypt to the same plaintext. This can be a problem in particular in the case of encrypting with a...
PT-2020-20372 · Google · Tink
Name of the Vulnerable Software and Affected Versions: Tink versions prior to 1.5 Description: A mis-handling of invalid unicode characters in the Java implementation of Tink allows an attacker to change the ID part of a ciphertext, resulting in the creation of a second ciphertext that can decryp...
CVE-2020-9916: Undefined Security Weakness
A URL Unicode encoding issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. A malicious attacker may be able to conceal the...
golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash
A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific...
glibc security, bug fix, and enhancement update
2.17-317.0.1 - Merge RH el7 u8 patches with Oracle patches Review-exception: Simple merge - Adding Mike Fabians C.utf-8 patch C.utf-8 is a unicode-aware version of the C locale Orabug 29784239. Reviewed-by: Jose E. Marchesi - Remove glibc-ora28641867.patch as duplicate of glibc-rh1705899-4.patch ...
Huawei EulerOS: Security Advisory for icu (EulerOS-SA-2020-2099)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2020-21991
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow crash. Technical details about the crash include the functions onigenc unicode get case fold codes by str,...
Spoofing Attacks
firefox is vulnerable to spoofing attacks. The vulnerability exists as the unicode latin kra character can be used to spoof a standard k character in the addressbar...
Cross-site Scripting (XSS)
firefox is vulnerable to cross-site scripting XSS. Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This allows malicious code to then be processed, evading cross-site scripting XSS filtering...
Arbitrary Code Execution
Git execute arbitrary commands via a tree containing a crafted .git/config file with 1 an ignorable Unicode codepoint, 2 a git1/config representation, or 3 mixed case that is improperly handled on a case-insensitive filesystem...
unicode-suche.de Cross Site Scripting vulnerability OBB-1348974
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode
An out-of-bounds read was discovered in PCRE when the pattern "\X" is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to crash the application...
golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash
A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific...
Debian DLA-2337-1 : python2.7 security update
Multiple vulnerabilities were discovered in Python2.7, an interactive high-level object-oriented language. CVE-2018-20852 By using a malicious server an attacker might steal cookies that are meant for other domains. CVE-2019-5010 NULL pointer dereference using a specially crafted X509 certificate...
libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled and \X or \R has more than one fixed quantifier a related issue to CVE-2019-20454.
...
CVE-2020-15651
A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the file extension. This vulnerability affects Firefox for iOS 28...
CVE-2020-15651
A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the file extension. This vulnerability affects Firefox for iOS 28...
Privilege escalation
A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the file extension. This vulnerability affects Firefox for iOS 28...
CVE-2020-15651
A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the file extension. This vulnerability affects Firefox for iOS 28...
CVE-2020-15651
A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the file extension. This vulnerability affects Firefox for iOS 28...