CVE-2017-17512High· 8.8▾ Twilightsensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL,…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.5 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
2.2%
2.2% → 2.4%
sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument.
sensible-utils < 0.0.11Upgrade past the affected range:
sensible-utils 0.0.11Connected by shared product, vendor, weakness, or advisory.
CVE-2023-29383Low· 3.3In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger)
CVE-2023-27533High· 8.8A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation
CVE-2022-0391High· 7.5A flaw was found in Python, specifically within the urllib.parse module
CVE-2020-8177High· 7.8curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.
CVE-2020-26116High· 7.2http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in…
CVE-2019-18348Medium· 6.1An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0