CVE-2018-8108: Improper Neutralization of Input During Web Page Generation

The select component in bui through 2018-03-13 has XSS because it performs an escape operation on already-escaped text, as demonstrated by workGroupList text...

CVE-2018-8045: Improper Neutralization of Special Elements used in an SQL Command

In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the User Notes list view...

CVE-2017-15719: Improper Neutralization of Input During Web Page Generation

In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor...

CVE-2018-0199: Improper Neutralization of Input During Web Page Generation

A vulnerability in Cisco Jabber Client Framework JCF could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of an affected device. The vulnerability is due to improper neutralization of script in attributes in a web page. An attacker could...

CVE-2018-6943: Improper Neutralization of Input During Web Page Generation

core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable...

CVE-2017-5799: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A Remote Code Execution vulnerability in HPE OpenCall Media Platform OCMP was found. The vulnerability impacts OCMP versions prior to 3.4.2 RP201 for OCMP 3.x, all versions prior to 4.4.7 RP702 for OCMP 4.x...

CVE-2017-5798: Improper Neutralization of Input During Web Page Generation

A Remote Code Execution vulnerability in HPE OpenCall Media Platform OCMP was found. The vulnerability impacts OCMP versions prior to 3.4.2 RP201 for OCMP 3.x, all versions prior to 4.4.7 RP702 for OCMP 4.x...

Command injection

Security Onion Solutions Squert version 1.0.1 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in .inc/callback.php that can result in execution of OS Commands. This attack appear to be exploitable via Web reques...

CVE-2018-6380: Improper Neutralization of Input During Web Page Generation

In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the module system...

CVE-2018-6376: Improper Neutralization of Special Elements used in an SQL Command

In Joomla! before 3.8.4, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Hathor postinstall message...

CVE-2018-5443: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection issue was discovered in Advantech WebAccess/SCADA versions prior to V8.220170817. WebAccess/SCADA does not properly sanitize its inputs for SQL commands...

Sql injection

A SQL Injection issue was discovered in Moxa SoftCMS Live Viewer through 1.6. An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability has been identified. Attackers can exploit this vulnerability to access SoftCMS without knowing the user's password...

CVE-2016-0324: Improper Neutralization of Special Elements used in a Command

IBM Security Identity Manager ISIM Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote authenticated users to execute arbitrary code with administrator privileges via unspecified vectors. IBM X-Force ID: 111640...

CVE-2017-16716: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection issue was discovered in WebAccess versions prior to 8.3. WebAccess does not properly sanitize its inputs for SQL commands...

CVE-2017-15714: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code "format=%27;alert%27xss%27" to the URL an alert window would execute...

Trend Micro Smart Protection Server Multiple Vulnerabilities

1. Advisory Information Title: Trend Micro Smart Protection Server Multiple Vulnerabilities Advisory ID: CORE-2017-0008 Advisory URL:https://www.coresecurity.com/core-labs/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities Date published: 2017-12-19 Date of last update:...

CVE-2017-17713: Improper Neutralization of Special Elements used in an SQL Command

Trape before 2017-11-05 has SQL injection via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register country parameter, the /register countryCode parameter, the /register cpu parameter, the /register isp parameter, the /register lat parameter, the...

CVE-2017-1465: Improper Neutralization of Input During Web Page Generation

IBM TRIRIGA 3.2, 3.3, 3.4, and 3.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against t...

CVE-2017-12346: Improper Neutralization of Input During Web Page Generation

Multiple vulnerabilities in Cisco Data Center Network Manager DCNM Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect a user to a malicious website, inject malicious content into a DCNM client interface, or conduct a cross-site scripting...

CVE-2017-1001003: Improper Neutralization of Argument Delimiters in a Command

math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object...