CVE-2017-5246

Biscom Secure File Transfer is vulnerable to AngularJS expression injection in the Display Name field. An authenticated user can supply a valid AngularJS expression ({{ … }}) which will be evaluated by other authenticated users viewing the attacker’s display name. Affected versions are 5.0.0000 t...

CVE-2017-5246: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Biscom Secure File Transfer is vulnerable to AngularJS expression injection in the Display Name field. An authenticated user can populate this field with a valid AngularJS expression, wrapped in double curly-braces . This expression will be evaluated by any other authenticated user who views the...

Expression injection vulnerability in e-mobile platform login.do page of Shanghai Panmicro Network Technology Co.

e-mobile is Panavision's mobile office product for cell phones, tablets and other mobile terminals. An expression injection vulnerability exists in the login.do page of the e-mobile platform of Shanghai Panmicro Network Technology Co. The vulnerability allows an attacker to remotely execute...

Spring Boot framework the expression injection vulnerability

No description provided by source...

Discuz! X-Series remote code execution vulnerability analysis-vulnerability warning-the black bar safety net

0x01 vulnerability root causes The root of the problem is that the api/uc. php file in the updatebadwords method, the code is as follows: function updatebadwords$get, $post global $G; if! APIUPDATEBADWORDS return APIRETURNFORBIDDEN; $data = array; ifisarray$post foreach$post as $k = $v...

CVE-2013-2251: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted 1 action:, 2 redirect:, or 3 redirectAction: prefix...