CVE-2020-9530: Improper Control of Generation of Code

An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. The export component of GetAppscom.xiaomi.mipicks mishandles the functionality of opening other components. Attackers need to induce users to open specific web pages in a specific network environment. By jumping to the WebView...

CVE-2019-3695: Improper Control of Generation of Code

A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for Developmen...

CVE-2019-4000: Improper Control of Generation of Code

Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attacker to execute arbitrary Python expressions with root privileges...

CVE-2020-8644: Improper Control of Generation of Code

PlaySMS before 1.4.3 does not sanitize inputs from a malicious string...

CVE-2020-5230: Improper Control of Resource Identifiers

Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. This can be problematic for operation and security since such identifiers are sometimes used for file system operations which may lead to an attacker being able to escape working directorie...

PT-2020-2767

Name of the Vulnerable Software and Affected Versions SUSE Linux Enterprise High Performance Computing 15-ESPOS pcp versions prior to 3.11.9-5.8.1 SUSE Linux Enterprise High Performance Computing 15-LTSS pcp versions prior to 3.11.9-5.8.1 SUSE Linux Enterprise Module for Development Tools 15 pcp...

CVE-2019-17309: Improper Control of Generation of Code

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user...

CVE-2019-16645: Improper Control of Generation of Code

An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages such as goform/login and config/logoffpage.htm create links containing a hostname obtained from an arbitrary HTTP Host header sent by an attacker. This could potentially be used in a phishing attack...

CVE-2019-2390: Improper Control of Generation of Code

An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Server v4.0 versions prior to 4.0.11; Mongo...

CVE-2019-0343: Improper Control of Generation of Code

SAP Commerce Cloud Mediaconversion Extension, versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application...

CVE-2019-12844: Improper Control of Generation of Code

A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.3...

CVE-2019-5443: Improper Control of Generation of Code

A non-privileged user or program can put code and a config file in a known non-privileged path under C:/usr/local/ that will make curl = 7.65.1 automatically run the code as an openssl "engine" on invocation. If that curl is invoked by a privileged user it can do anything it wants...

The vulnerability of the monitoring panel for Cisco Unified Intelligence Center’s reporting functions allows a perpetrator to compromise the confidentiality and integrity of the protected information.

The vulnerability of the monitoring panel for creating Cisco Unified Intelligence Center reports is related to improper control of resource identifiers. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information by usin...

CVE-2019-8324: Improper Control of Generation of Code

An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensureloadablespec during the preinstall check...

CVE-2019-1860: Improper Control of Resource Identifiers

A vulnerability in the dashboard gadget rendering of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to obtain or manipulate sensitive information between a user’s browser and Cisco Unified Intelligence Center. The vulnerability is due to the lack of gadget...

IBM Security Key Lifecycle Manager: All Security Bulletins

Summary This page lists all the security bulletins that are released for IBM Security Key Lifecycle Manager. Vulnerability Details Security Bulletin: IBM Security Key Lifecycle Manager stores unencrypted password CVE-2016-6092 --- Security Bulletin: IBM Security Key Lifecycle Manager uses Less...

CVE-2011-1830: Improper Control of Generation of Code

Ekiga versions before 3.3.0 attempted to load a module from /tmp/ekigatest.so...

GHSA-JPV3-G4CC-6VFX Improper Control of Generation of Code ('Code Injection') in org.apache.activemq:activemq-client

In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive...

CVE-2018-20773: Improper Control of Generation of Code

Frog CMS 0.9.5 allows PHP code execution by visiting admin/?/page/edit/1 and inserting additional...

CVE-2018-18258: Improper Control of Generation of Code

An issue was discovered in BageCMS 3.1.3. The attacker can execute arbitrary PHP code on the web server and can read any file on the web server via an index.php?r=admini/template/updateTpl&filename= URI...