CVE-2016-4397: Improper Control of Generation of Code

A local code execution security vulnerability was identified in HP Network Node Manager i NNMi v10.00, v10.10 and v10.20 Software...

CVE-2016-5713: Improper Control of Generation of Code

Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol PXP agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded. This bug was first introduced in Puppet Agent 1.3.0...

CVE-2014-8872: Improper Control of Generation of Code

Improper Verification of Cryptographic Signature in AVM FRITZ!Box 6810 LTE after firmware 5.22, FRITZ!Box 6840 LTE after firmware 5.23, and other models with firmware 5.50...

CVE-2017-6782: Improper Control of Generation of Code

A vulnerability in the administrative web interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to modify a page in the web interface of the affected application. The vulnerability is due to improper sanitization of parameter values by the affected application. An...

CVE-2017-11675: Improper Control of Generation of Code

The traverseStrictSanitize function in admindir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to execute arbitrary PHP code by placing that code into an invalid array index of the adminname array parameter to...

CVE-2016-7787: Improper Control of Generation of Code

A maliciously crafted command line for kdesu can result in the user only seeing part of the commands that will actually get executed as super user...

CVE-2016-7968: Improper Control of Generation of Code

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript and included code was executed...

CVE-2016-7967: Improper Control of Generation of Code

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled...

CVE-2016-5424: Improper Control of Generation of Code

PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a 1 " double quote, 2 \ backslash, 3 carriage return, or 4 newline character ...

CVE-2014-8669: Improper Control of Generation of Code

The SAP Promotion Guidelines CRM-MKT-MPL-TPM-PPG module for SAP CRM allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2011-2702: Improper Control of Generation of Code

Integer signedness error in Glibc before 2.13 and eglibc before 2.13, when using Supplemental Streaming SIMD Extensions 3 SSSE3 optimization, allows context-dependent attackers to execute arbitrary code via a negative length parameter to 1 memcpy-ssse3-rep.S, 2 memcpy-ssse3.S, or 3 memset-sse2.S ...

CVE-2014-4043: Improper Control of Generation of Code

The posixspawnfileactionsaddopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities...

CVE-2006-1318: Improper Control of Generation of Code

Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability."...

CVE-2014-2866: Improper Control of Generation of Code

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on client JavaScript code for access restrictions, which allows remote attackers to perform unspecified operations by modifying this code...

CVE-2013-6385: Improper Control of Generation of Code

The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even when CSRF validation has failed, which might allow remote attackers to trigger application-specific impacts such as arbitrary code execution via...

CVE-2013-4478: Improper Control of Generation of Code

Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment...

CVE-2013-4330: Improper Control of Generation of Code

Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple" in a CamelFileName message header to a 1 FILE or 2 FTP producer...

CVE-2013-4338: Improper Control of Generation of Code

wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations...

CVE-2013-1323: Improper Control of Generation of Code

Microsoft Publisher 2003 SP3 does not properly handle NULL values for unspecified data items, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Incorrect NULL Value Handling Vulnerability."...

CVE-2012-4143: Improper Control of Generation of Code

Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, allows user-assisted remote attackers to trick users into downloading and executing arbitrary files via a small window for the download dialog, a different vulnerability than CVE-2012-1924...