Steffen Joeris

The issue concerns the OpenID module in Drupal, which fails to verify the `openid.return to` value as per the OpenID 2.0 protocol. This allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.

The issue concerns the OpenID module in Drupal, which fails to adhere to the OpenID 2.0 protocol. Specifically, it does not check for the reuse of `openid.response nonce` values. This oversight allows remote attackers to bypass authentication by utilizing an assertion from an OpenID provider.

The issue allows remote authenticated users with certain privileges to inject arbitrary web script or HTML via various means, including an action description, an action message, a node, or a taxonomy term. This is related to the actions feature and the trigger module.

The issue allows remote authenticated users with certain privileges to bypass intended access restrictions and reinstate removed comments via a crafted URL, related to an "unpublishing bypass" issue.

The issue arises from the upload module's improper handling of case-insensitive filename handling in a database configuration. This allows remote authenticated users to bypass intended restrictions on downloading a file by uploading a different file with a similar name.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via certain Custom Fields. This can be achieved by exploiting the vulnerability in Custom Fields, which enables the injection of malicious code.

Name of the Vulnerable Software and Affected Versions: PyGreSQL versions 3.8.1 and 4.0 Description: The issue arises from improper support of the PQescapeStringConn function in the pygresql module, potentially allowing remote attackers to exploit escaping issues involving multibyte character encodings. This can lead to SQL injections when processing certain multi-byte character sequences. The problem is due to PyGreSQL not using PostgreSQL's safe string and bytea functions in its own escaping functions. Recommendations: For PyGreSQL version 3.8.1, adjust applications to use the new connection.escape string() and connection.escape bytea() functions instead of pg.escape string() and pg.escape bytea(). For PyGreSQL version 4.0, adjust applications to use the new connection.escape string() and connection.escape bytea() functions instead of pg.escape string() and pg.escape bytea().

The issue concerns multiple vulnerabilities in the libpurple package, which can be exploited remotely to disrupt the confidentiality of protected information. Specifically, the `protocols/jabber/auth.c` file in libpurple does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification. This causes libpurple to connect to the server without the expected encryption, allowing remote attackers to sniff sessions.

Name of the Vulnerable Software and Affected Versions: Coccinelle version 0.1.7 Description: The issue allows local users to overwrite arbitrary files via a symlink attack on an unspecified result file. Recommendations: For version 0.1.7, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows remote attackers to conduct SQL injection attacks using multibyte character encodings due to the use of the `addslashes` function instead of the `mysql real escape string` function.

The issue is related to the originates from local legacy unicast socket function in avahi-daemon, which does not properly handle the network byte order of a port number when processing incoming multicast packets. This allows remote attackers to cause a denial of service by consuming network bandwidth and CPU resources via a crafted legacy unicast mDNS query packet that triggers a multicast packet storm. The vulnerability can be exploited remotely and may lead to disruption of protected information availability.

The issue allows remote attackers to cause a denial of service by signing a message with a revoked key, triggering an assertion error.

The issue is related to an untrusted search path vulnerability in the BPY interface of Blender, allowing local users to execute arbitrary code via a Trojan horse Python file in the current working directory. This is due to an erroneous setting of `sys.path` by the `PySys SetArgv` function.

The issue allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs, specifically through the ` httpsrequest` function in Snoopy.

Name of the Vulnerable Software and Affected Versions: FAAD2 versions 2.6.1 and earlier Description: The issue is related to a heap-based buffer overflow in the decodeMP4file function, located in frontend/main.c. This can be triggered by remote attackers using a crafted MPEG-4 (MP4) file, potentially leading to a denial of service (crash) and possibly allowing the execution of arbitrary code. Recommendations: For FAAD2 versions 2.6.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

A heap-based buffer overflow issue exists in the open man file function, located in callbacks.c, due to improper handling during utf8 conversion of a crafted man page. This could allow remote attackers to execute arbitrary code.

The issue is related to a stack-based buffer overflow in the `str read packet` function, which can be exploited by remote attackers to cause a denial of service or execute arbitrary code via a crafted STR file. This can lead to an application crash or allow an attacker to execute arbitrary code. The vulnerability is caused by the interleaving of audio and video sectors in a specially crafted STR file.