CVE-2021-24712: Improper Neutralization of Input During Web Page Generation

The Appointment Hour Booking WordPress plugin before 1.3.17 does not properly sanitize values used when creating new calendars...

CVE-2021-36175

FortiWebManager (Fortinet) is affected by CVE-2021-36175. The issue is an input handling flaw (CWE-79) that could allow an authenticated remote attacker to inject malicious script/tags through the name, description, or comments fields in several sections of FortiWebManager. Affected versions are ...

CVE-2021-24016

Fortinet FortiManager vulnerability CVE-2021-24016: An improper neutralization of formula elements in policy-name CSV/Excel fields can lead to arbitrary shell commands when a crafted IPv4 field is included and the exported configuration file is opened unsafely. Affected are FortiManager 6.4.3 and...

CVE-2021-38124: Improper Neutralization of Special Elements used in a Command

Remote Code Execution vulnerability in Micro Focus ArcSight Enterprise Security Manager ESM product, affecting versions 7.0.2 through 7.5. The vulnerability could be exploited resulting in remote code execution...

CVE-2021-23445: Improper Neutralization of Input During Web Page Generation

This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped...

PT-2021-22021

Name of the Vulnerable Software and Affected Versions: btcpayserver affected versions not specified Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This means that the software does not properly neutralize user...

PT-2021-21951

Name of the Vulnerable Software and Affected Versions: adminlte affected versions not specified Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This means that the software does not properly validate user input,...

CVE-2021-3783

yourls is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-39205: Improper Neutralization of Input During Web Page Generation

Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the...

CVE-2021-40814: Improper Neutralization of Special Elements used in an SQL Command

The Customer Photo Gallery addon before 2.9.4 for PrestaShop is vulnerable to SQL injection...

CVE-2021-37718: Improper Neutralization of Special Elements used in a Command

A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software versions: Prior to 8.6.0.4-2.2.0.6; Prior to 8.7.1.4, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS...

CVE-2021-37722: Improper Neutralization of Special Elements used in a Command

A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software versions: Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and...

CVE-2021-37719: Improper Neutralization of Special Elements used in a Command

A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software versions: Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and...

CVE-2021-37721: Improper Neutralization of Special Elements used in a Command

A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software versions: Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and...

CVE-2021-37720: Improper Neutralization of Special Elements used in a Command

A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software versions: Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and...

CVE-2021-3767

bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-36024: Improper Neutralization of Special Elements used in an OS Command

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an Improper Neutralization of Special Elements Used In A Command via the Data collection endpoint. An attacker with admin privileges can upload a specially crafted file to achieve remote code...

CVE-2020-18875: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client configurations via vtl velocity files...

CVE-2021-21595: Improper Neutralization of Special Elements used in a Command

Dell EMC PowerScale OneFS versions 8.2.x - 9.1.1.x contain an improper neutralization of special elements used in an OS command. This vulnerability could allow the compadmin user to elevate privileges. This only impacts Smartlock WORM compliance mode clusters as a critical vulnerability and Dell...

CVE-2021-24411: Improper Neutralization of Input During Web Page Generation

The Social Tape WordPress plugin through 1.0 does not have CSRF checks in place when saving its settings, and do not sanitise or escape them before outputting them back in the page, leading to a stored Cross-Site Scripting issue via a CSRF attack...