Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-1142PUBLISHED: 2023-03-27In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass authentication resulting in privilege escalation.
CVE-2023-1143PUBLISHED: 2023-03-27In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use Lua scripts, which could allow an attacker to remotely execute arbitrary code.
CVE-2023-1144PUBLISHED: 2023-03-27Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Gateway service and bypass authorization, which could result in privilege escalation.
CVE-2023-1145PUBLISHED: 2023-03-27Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
CVE-2023-1655PUBLISHED: 2023-03-27Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.
User Rank: Strategist
3/4/2019 | 5:34:35 PM
In general, providing an input with an apostrophe should be considered valid, even if the backend uses this value in an SQL query (as the real data being search may have such values, e.g. Name: O'Neill). If I include the text "<grin>" with-in some online forum post/comment, it shouldn't be rejected/removed for no-HTML input fields, but be treated as verbatuim text that is properly escaped in output HTML.
Input validation should normally only be done for specific business logic (e.g. usernames are limited to ASCII letters/numbers and must start with a letter), or general sanity checks (e.g. only ASCII; only valid UTF-8 encoded strings; doesn't contain invalid UNICODE composed sequences; no embedded NUL characters [when using length specified strings]).