2422 matches found
CVE-2022-41928 XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml
XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' in AttachmentSelector.xml. The issue can also be reproduced by inserting the dangerous payload in the height or alt macro properties. This has been patched in versions 13.10.7, 14.4.2...
CVE-2022-41931 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui
xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection'. Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper...
Improper Neutralization
Overview Affected versions of this package are vulnerable to Improper Neutralization in the self.metaset function of the component Meta Protocol Handler. PoC ruby require 'dalli' $mcmeta = Dalli::Client.new'localhost:11211', protocol: :meta $mcmeta.set'xhzeem','meta' $mcmeta.get"xhzeem"...
CVE-2022-40752
IBM InfoSphere DataStage 11.7 is vulnerable to a command injection vulnerability due to improper neutralization of special elements. IBM X-Force ID: 236687...
Command injection
IBM InfoSphere DataStage 11.7 is vulnerable to a command injection vulnerability due to improper neutralization of special elements. IBM X-Force ID: 236687...
CVE-2022-33870
An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the command line interpreter of FortiTester 3.0.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an authenticated attacker to execute unauthorized commands via specifically crafted...
CVE-2022-40176
A vulnerability has been identified in Desigo PXM30-1 All versions V02.20.126.11-41, Desigo PXM30.E All versions V02.20.126.11-41, Desigo PXM40-1 All versions V02.20.126.11-41, Desigo PXM40.E All versions V02.20.126.11-41, Desigo PXM50-1 All versions V02.20.126.11-41, Desigo PXM50.E All versions...
CVE-2022-39217 Improper Neutralization of Formula Elements in a CSV File in ghas-to-csv
some-natalie/ghas-to-csv GitHub Advanced Security to CSV is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom...
PT-2022-6547 · Fortinet · Fortiadc +2
Name of the Vulnerable Software and Affected Versions: FortiADC versions 5.x through 7.1.0 FortiDDoS versions 4.x through 5.6 FortiDDoS-F versions 6.1.0 through 6.4.0 Description: The issue is related to an improper neutralization of special elements used in an OS command, which may allow an...
CVE-2022-35847
An improper neutralization of special elements used in a template engine vulnerability CWE-1336 in FortiSOAR management interface 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.4 may allow a remote and authenticated attacker to execute arbitrary code via a crafted payload...
CVE-2022-29058
An improper neutralization of special elements CWE-89 used in an OS command vulnerability CWE-78 in the command line interpreter of FortiAP 6.0.0 through 6.4.7, 7.0.0 through 7.0.3, 7.2.0, FortiAP-S 6.0.0 through 6.4.7, FortiAP-W2 6.0.0 through 6.4.7, 7.0.0 through 7.0.3, 7.2.0 and FortiAP-U 5.4....
CVE-2022-21225
Improper neutralization in the IntelR Data Center Manager software before version 4.1 may allow an authenticated user to potentially enable escalation of privilege via adjacent access...
CVE-2022-38357
Improper neutralization of special elements leaves the Eyes of Network Web application vulnerable to an iFrame injection attack, via the url parameter of /module/moduleframe/index.php...
CVE-2022-22280
Improper Neutralization of Special Elements used in an SQL Command leading to Unauthenticated SQL Injection vulnerability, impacting SonicWall GMS 9.3.1-SP2-Hotfix1, Analytics On-Prem 2.5.0.3-2520 and earlier versions...
CVE-2022-2323
Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remote code execution in the host system. This vulnerability impacts SonicWall Switch 1.1.1.0-2s and earlier versions...
The vulnerability of the Red Database database management system lies in the improper neutralization of equivalent special elements, allowing attackers to provide unreliable data during a search query.
The vulnerability of the RedBase database management system is related to the improper neutralization of equivalent special elements. Exploiting this vulnerability allows an attacker to provide unreliable data during a search using Distinguished Names, by employing special symbols...
Design/Logic Flaw
An improper neutralization of input during web page generation vulnerability CWE-79 in FortiAuthenticator OWA Agent for Microsoft version 2.2 and 2.1 may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests...
The vulnerability of the command-line interface (CLI) implementation of Zyxel networking devices allows a perpetrator to execute arbitrary commands.
The vulnerability of CLI implementations for Zyxel network devices involves the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...
Cross site request forgery (csrf)
Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user...