Web Isolation Arbitrary Code Injection

The vulnerability of the software for preventing web threats exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor, operating remotely, to inject arbitrary code into the loaded web page using a specially crafted URI...

Cisco Prime Service Catalog Injection

The vulnerability of the Cisco Prime Service Catalog management server relates to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the web page via a specially crafted link...

Cisco Registered Envelope Service Injection

The vulnerability of the web interface for managing security information transmitted by the Cisco Registered Envelope Service is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the...

Microsoft Dynamics 365 Arbitrary Code Injection

The vulnerability of the Microsoft Dynamics 365 resource planning software application is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the web pages uploaded to users, thereby gaining access to...

PT-2018-1786

Name of the Vulnerable Software and Affected Versions Microsoft Dynamics 365 affected versions not specified Description The issue is related to insufficient protection of the web page structure in Microsoft Dynamics 365, allowing a remote attacker to inject arbitrary code into a user-loaded web...

CVE-2018-17783

A cross-site scripting XSS vulnerability in the Edit Filter page managefilteredit page.php in MantisBT 2.1.0 through 2.17.1 allows remote attackers if access rights permit it to inject arbitrary code if CSP settings permit it through a crafted project name...

CVE-2018-17782

A cross-site scripting XSS vulnerability in the Manage Filters page managefilterpage.php in MantisBT 2.1.0 through 2.17.1 allows remote attackers if access rights permit it to inject arbitrary code if CSP settings permit it through a crafted project name...

PT-2018-14194

Name of the Vulnerable Software and Affected Versions MantisBT versions 2.1.0 through 2.17.1 Description A cross-site scripting issue in the Edit Filter page allows remote attackers to inject arbitrary code through a crafted project name, provided access rights and CSP settings permit it...

CVE-2018-17904

Reliance 4 SCADA/HMI, Version 4.7.3 Update 3 and prior. This vulnerability could allow an unauthorized attacker to inject arbitrary code...

CVE-2018-17904

Geovap Reliance 4 SCADA/HMI is vulnerable to cross-site scripting (CWE-79) in the web interface. Affected: Reliance 4 SCADA/HMI, Version 4.7.3 Update 3 and earlier. Description in ICS-CERT confirms an unauthenticated remote attacker can inject arbitrary JavaScript via HTTP, potentially impacting ...

PT-2018-14256

Name of the Vulnerable Software and Affected Versions Reliance 4 SCADA/HMI versions prior to 4.7.3 Update 3 Description This issue could allow an unauthorized attacker to inject arbitrary code, potentially leading to unauthorized access and control. Recommendations For versions prior to 4.7.3...

CVE-2018-17904: Improper Neutralization of Input During Web Page Generation

Reliance 4 SCADA/HMI, Version 4.7.3 Update 3 and prior. This vulnerability could allow an unauthorized attacker to inject arbitrary code...

GHSA-CGQV-X5CX-XVQH Arbitrary Code Injection in pouchdb

Affected versions of pouchdb do not properly sandbox the code execution engine which executes the map/reduce functions for temporary views and design documents. Under certain circumstances, an attacker could uses this to run arbitrary code on the server. Recommendation Update to version 6.0.5 or...

CVE-2018-9062: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In some Lenovo ThinkPad products, one BIOS region is not properly included in the checks, allowing injection of arbitrary code...

Adobe Systems Main lead DBMS Arbitrary Code Injection

Document Title: =============== Adobe Systems - Arbitrary Code Injection Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2120 PSIRT ID: 7873 Vulnerability Magazine:...

PT-2018-18823

Name of the Vulnerable Software and Affected Versions Lenovo ThinkPad affected versions not specified Description The issue allows for the injection of arbitrary code due to a BIOS region not being properly included in checks. Recommendations At the moment, there is no information about a newer...

Adobe Systems - Arbitrary Code Injection Vulnerability

Document Title: =============== Adobe Systems - Arbitrary Code Injection Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2120 PSIRT ID: 7873 Vulnerability Magazine:...

Adobe Systems - Arbitrary Code Injection Vulnerability

Document Title: =============== Adobe Systems - Arbitrary Code Injection Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2120 PSIRT ID: 7873 Vulnerability Magazine:...

GHSA-4662-J96G-MV46 Arbitrary Code Injection in reduce-css-calc

Affected versions of reduce-css-calc pass input directly to eval. If user input is passed into the calc function, this may result in cross-site scripting on the browser, or remote code execution on the server. Proof of Concept const reduceCSSCalc = require'reduce-css-calc';...

CVE-2016-10546

An arbitrary code injection vector was found in PouchDB 6.0.4 and lesser via the map/reduce functions used in PouchDB temporary views and design documents. The code execution engine for this branch is not properly sandboxed and may be used to run arbitrary JavaScript as well as system commands...