CVE-2019-14862: Improper Neutralization of Input During Web Page Generation

There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it...

CVE-2019-14863: Improper Neutralization of Input During Web Page Generation

There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it...

CVE-2013-4692: Improper Neutralization of Input During Web Page Generation

Xorbin Analog Flash Clock 1.0 extension for Joomia has XSS...

CVE-2019-13181: Improper Neutralization of Formula Elements in a CSV File

A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7...

CVE-2019-17123: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields to /system/ws/v11/ss/email are mishandled, as demonstrated by fromName header injection with a %0a or %0d character. Also, the message parameter can have initial HTML comment characters...

CVE-2019-3986: Improper Neutralization of Special Elements used in an OS Command

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the encryption parameter...

CVE-2019-1490: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A spoofing vulnerability exists when a Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business Server Spoofing Vulnerability'...

CVE-2013-2745: Improper Neutralization of Special Elements used in an SQL Command

An SQL Injection vulnerability exists in MiniDLNA prior to 1.1.0...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webclient of Siemens AG Polarion could allow an attacker to exploit a reflected XSS vulnerability. This issue affects: Siemens AG Polarion All versions 19.2...

PT-2019-13481

Name of the Vulnerable Software and Affected Versions Siemens AG Polarion versions prior to 19.2 Description The issue is related to improper neutralization of input during web page generation, which could allow an attacker to exploit a reflected Cross-site Scripting XSS vulnerability...

CVE-2019-17650

An Improper Neutralization of Special Elements used in a Command vulnerability in one of FortiClient for Mac OS root processes, may allow a local user of the system on which FortiClient is running to execute unauthorized code as root by bypassing a security check...

CVE-2019-18857: Improper Neutralization of Input During Web Page Generation

darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript :alert substring...

CVE-2009-5049: Improper Neutralization of Input During Web Page Generation

WebApp JSP Snoop page XSS in jetty though 6.1.21...

CVE-2015-9514: Improper Neutralization of Input During Web Page Generation

The Easy Digital Downloads EDD Free Downloads extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...

CVE-2015-9520: Improper Neutralization of Input During Web Page Generation

The Easy Digital Downloads EDD Per Product Emails extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...

CVE-2015-9532: Improper Neutralization of Input During Web Page Generation

The Easy Digital Downloads EDD Digital Store theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...

CVE-2015-9508: Improper Neutralization of Input During Web Page Generation

The Easy Digital Downloads EDD Commissions extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...

CVE-2015-9523: Improper Neutralization of Input During Web Page Generation

The Easy Digital Downloads EDD Recommended Products extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...

CVE-2015-9505: Improper Neutralization of Input During Web Page Generation

The Easy Digital Downloads EDD core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7 for WordPress has XSS because addqueryarg is misused...

CVE-2015-9522: Improper Neutralization of Input During Web Page Generation

The Easy Digital Downloads EDD QR Code extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...