postgresql-server -- CREATE SCHEMA ... schema elements defeats protective search_path changes

PostgreSQL Project reports This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. Database owners have that right by default, and explicit grants may extend it to other users...

CVE-2023-2629

Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9...

Stored Cross-Site Scripting (XSS)

apacheairflow is vulnerable to Stored Cross-Site Scripting XSS attacks. The library uses template literals to construct html elements, which allows an attacker to execute malicious JavaScript on victim's browser through XSS payloads stored on the application server...

CVE-2023-2629 Improper Neutralization of Formula Elements in a CSV File in pimcore/customer-data-framework

Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9...

The vulnerability of the Prompts component in the Google Chrome browser allows attackers to carry out phishing attacks.

The vulnerability of the Prompts component in the Google Chrome browser is related to improperly implemented security checks for standard elements. Exploiting this vulnerability allows a malicious actor to carry out phishing attacks using a specially created HTML page...

CVE-2023-2629

Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9...

CVE-2023-27999

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in FortiADC 7.2.0, 7.1.0 through 7.1.1 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...

CVE-2023-27999

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in FortiADC 7.2.0, 7.1.0 through 7.1.1 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...

Important: golang

Issue Overview: Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption. CVE-2022-23772 cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This...

The vulnerability of the FortiADC application delivery controller and the FortiDDoS/FortiDDoS-F software and hardware protection devices relates to the failure to take measures to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.

The vulnerabilities of the FortiADC application delivery controller and the FortiDDoS/FortiDDoS systems for DDoS attacks are related to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting these vulnerabilities allows a remote attacker t...

CVE-2023-29918: Improper Neutralization of Formula Elements in a CSV File

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module...

The vulnerability of the microprogramming software in the remote terminal block INEA ME RTU arises from the lack of measures taken to neutralize special elements used in the operating system’s commands. This allows a perpetrator to execute arbitrary code.

The vulnerability of the microprogrammed remote terminal block INEA ME RTU exists due to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2022-36769: Improper Neutralization of Special Elements used in a Command

IBM Cloud Pak for Data 4.5 and 4.6 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 232034...

Git for Windows 代码问题漏洞

Git for Windows is Git's Git for Windows. A code issue vulnerability exists in Git for Windows versions prior to 2.40.1 that stems from uncontrolled search path elements...

CVE-2023-2258

Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304...

CVE-2023-2258: Improper Neutralization of Formula Elements in a CSV File

Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304...

CVE-2023-2259 Improper Neutralization of Special Elements Used in a Template Engine in alfio-event/alf.io

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304...

alf.io 安全漏洞

alf.io is open source ticket reservation system. alfio-event A security vulnerability exists in alf.io versions prior to 2.0-M4-2304, which stems from improper neutralization of formula elements in CSV files...

Google Android elevation of privilege vulnerability (CNVD-2023-55380)

Google Android is a Linux-based open source operating system from Google. An elevation of privilege vulnerability exists in Google Android, which stems from the FileUtils.java component's extractRelativePath store failing to correctly filter special elements in the path of a resource or file, whi...

Command injection

A CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that allows a local privilege escalation on the appliance when a maliciously crafted Operating System command is entered on the device. Affected products: StruxureWare Data Cent...