CVE-2017-2692: Improper Neutralization of Special Elements used in a Command

The Keyguard application in ALE-L02C635B140 and earlier versions,ALE-L02C636B140 and earlier versions,ALE-L21C10B150 and earlier versions,ALE-L21C185B200 and earlier versions,ALE-L21C432B214 and earlier versions,ALE-L21C464B150 and earlier versions,ALE-L21C636B200 and earlier...

CVE-2017-16798: Improper Neutralization of Input During Web Page Generation

In CMS Made Simple 2.2.3.1, the isfileacceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a "php" substring, which allows remote attackers to bypass intended access restrictions or trigger XSS via other extensions, as demonstrated by...

CVE-2017-11777: Improper Neutralization of Input During Web Page Generation

Microsoft SharePoint Enterprise Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an attacker to exploit a cross-site scripting XSS vulnerability by sending a specially crafted request to an affected SharePoint server, due to how SharePoint Server sanitizes web requests, aka...

CVE-2017-1407: Improper Neutralization of Special Elements used in a Command

IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID:...

Command injection

An Improper Neutralization of Special Elements used in an OS Command issue was discovered in Digium Asterisk GUI 2.1.0 and prior. An OS command injection vulnerability has been identified that may allow the execution of arbitrary code on the system through the inclusion of OS commands in the URL...

CVE-2015-5169: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Apache Struts before 2.3.20...

CVE-2017-14723: Improper Neutralization of Special Elements used in an SQL Command

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb-prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks...

Foscam IP Video Camera CGIProxy.fcgi SMTP Test Host Parameter Configuration Command Injection Vulnerability(CVE-2017-2841)

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting...

CVE-2015-3161: Improper Neutralization of Input During Web Page Generation

The search bar code in bkr/server/widgets.py in Beaker before 20.1 does not escape tags in string literals when producing JSON...

CVE-2014-8753: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Cit-e-Net Cit-e-Access 6...

Trend Micro Smart Protection OS Command Injection

1. Advisory Information Title: Trend Micro Smart Protection OS Command Injection Advisory ID: CORE-2017-0004 Advisory URL:http://www.coresecurity.com/core-labs/advisories/trend-micro-smart-protection-os-command-injection Date published: 2017-08-23 Date of last update: 2017-08-23 Vendors contacted...

CVE-2017-6327: Improper Neutralization of Special Elements used in a Command

The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target process. In this type of occurrence, after gaining access to t...

CVE-2017-9338: Improper Neutralization of Input During Web Page Generation

Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2. To be exploitable a user has to write or paste malicious content into the search dialogue...

CVE-2017-1000006: Improper Neutralization of Input During Web Page Generation

Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue...

CVE-2015-6959: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Vindula 1.9...

Command injection

An Improper Neutralization of Special Elements in an OS command issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An improper neutralization of special elements vulnerability has been identified. If special elements are not properly neutralized, an attacker can call...

CVE-2017-5173

Geutebrück G-Cam/EFD-2250 (Firmware 1.11.0.12) is affected by two CVEs: CVE-2017-5173 (Improbable neutralization of special elements in OS commands) and CVE-2017-5174 (Authentication bypass). CVE-5174 enables remote authentication bypass; CVE-5173 can allow remote code execution via crafted reque...

CVE-2017-7984: Improper Neutralization of Input During Web Page Generation

In Joomla! 3.2.0 through 3.6.5 fixed in 3.7.0, inadequate filtering leads to XSS in the template manager component...

CVE-2017-3557: Improper Neutralization of Input During Web Page Generation

Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite subcomponent: Print Server. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP t...

CVE-2017-7722: Improper Neutralization of Special Elements used in a Command

In SolarWinds Log & Event Manager LEM before 6.3.1 Hotfix 4, a menu system is encountered when the SSH service is accessed with "cmc" and "password" the default username and password. By exploiting a vulnerability in the restrictssh feature of the menuing script, an attacker can escape from the...