Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 28 Oct 2026 13:57:08 +0000 cnvd-2018-11252 https://cve.radiocsirt.org/vuln/cnvd-2018-11252 cnvd-2018-11252 https://cve.radiocsirt.org/vuln/cnvd-2018-11252 EUVD-2026-79575 https://cve.radiocsirt.org/vuln/euvd-2026-79575 EUVD-2026-79575 https://cve.radiocsirt.org/vuln/euvd-2026-79575 fkie_cve-2017-17520 https://cve.radiocsirt.org/vuln/fkie_cve-2017-17520 <p>tools/url_handler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has reported that this is intentional behavior, because the documentation states &#34;url_handler.pl was designed to work together with tin which only issues shell escaped absolute URLs.</p> <p>tools/url_handler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has reported that this is intentional behavior, because the documentation states &#34;url_handler.pl was designed to work together with tin which only issues shell escaped absolute URLs.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2017-17520 GHSA-569q-x9r8-48cw https://cve.radiocsirt.org/vuln/ghsa-569q-x9r8-48cw <p>** DISPUTED ** tools/url_handler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has reported that this is intentional behavior, because the documentation states &#34;url_handler.pl was designed to work together with tin which only issues shell escaped absolute URLs.&#34;</p> <p>** DISPUTED ** tools/url_handler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has reported that this is intentional behavior, because the documentation states &#34;url_handler.pl was designed to work together with tin which only issues shell escaped absolute URLs.&#34;</p> https://cve.radiocsirt.org/vuln/ghsa-569q-x9r8-48cw gsd-2017-17520 https://cve.radiocsirt.org/vuln/gsd-2017-17520 gsd-2017-17520 https://cve.radiocsirt.org/vuln/gsd-2017-17520