Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data (e.g.names) and ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages, when printed, are also not being sanitized. This issue is fixed in version 0.10.0.
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.
Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
CVE-2025-58160 is a low-severity vulnerability in the tokio-rs tracing framework's tracing-subscriber component prior to version 0.3.20. It involves improper neutralization of ANSI escape sequences in untrusted input that is logged and displayed in terminal emulators. This can allow attackers to inject ANSI sequences that manipulate terminal output, such as changing terminal titles or clearing the screen, potentially misleading users. The issue is fixed in version 0.3.20 by escaping ANSI control characters in terminal output. No known exploits have been reported in the wild.
Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.
In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.
IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD console could allow an authenticated user to execute code due to improper neutralization of escape characters.
CVE-2024-50349 is a vulnerability in Git where the terminal prompt for credentials prints hostnames without properly encoding or escaping ANSI escape sequences. This can allow attackers to craft malicious URLs that manipulate the terminal display, potentially misleading users into providing credentials to attacker-controlled sites. The issue affects multiple Git versions and has been fixed in version 2.47.2 and later. Users are advised to upgrade to patched versions or avoid cloning from untrusted URLs.
CVE-2024-52006 is a low-severity vulnerability in Git involving improper encoding or escaping of output in the Git credential helper protocol. Certain ecosystems like .NET and node.js interpret single Carriage Return characters as newlines, which bypasses protections against a previous vulnerability (CVE-2020-5260). This flaw affects multiple Git versions prior to fixed releases. The issue is addressed in Git versions 2.47.2 and later. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones.