CVE-2020-6392: Improper Neutralization of Input During Web Page Generation

Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension...

CVE-2011-1084: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in Smoothwall Express 3...

CVE-2019-15619

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...

CVE-2020-8421: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in comactionlogs...

CVE-2019-15586: Improper Neutralization of Input During Web Page Generation

A XSS exists in Gitlab CE/EE 12.1.10 in the Mermaid plugin...

Sql injection

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in susestudio-ui-server of SUSE Studio onsite allows remote attackers with admin privileges in Studio to alter SQL statements, allowing for extraction and modification of data. This issue affects:...

CVE-2013-0286: Improper Neutralization of Input During Web Page Generation

Pinboard 1.0.6 theme for Wordpress has XSS...

CVE-2020-6843: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959...

CVE-2020-5853: Improper Neutralization of Input During Web Page Generation

In BIG-IP APM portal access on versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, when backend servers serve HTTP pages with special JavaScript code, this can lead to internal portal access name conflict...

CVE-2019-14863: Improper Neutralization of Input During Web Page Generation

There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it...

CVE-2019-14862: Improper Neutralization of Input During Web Page Generation

There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it...

CVE-2013-4692: Improper Neutralization of Input During Web Page Generation

Xorbin Analog Flash Clock 1.0 extension for Joomia has XSS...

CVE-2019-13181: Improper Neutralization of Formula Elements in a CSV File

A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7...

CVE-2019-17123: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields to /system/ws/v11/ss/email are mishandled, as demonstrated by fromName header injection with a %0a or %0d character. Also, the message parameter can have initial HTML comment characters...

CVE-2019-3986: Improper Neutralization of Special Elements used in an OS Command

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the encryption parameter...

CVE-2019-1490: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A spoofing vulnerability exists when a Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business Server Spoofing Vulnerability'...

CVE-2013-2745: Improper Neutralization of Special Elements used in an SQL Command

An SQL Injection vulnerability exists in MiniDLNA prior to 1.1.0...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webclient of Siemens AG Polarion could allow an attacker to exploit a reflected XSS vulnerability. This issue affects: Siemens AG Polarion All versions 19.2...

CVE-2019-17650

An Improper Neutralization of Special Elements used in a Command vulnerability in one of FortiClient for Mac OS root processes, may allow a local user of the system on which FortiClient is running to execute unauthorized code as root by bypassing a security check...

CVE-2019-18857: Improper Neutralization of Input During Web Page Generation

darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript :alert substring...