3331 matches found
CVE-2022-22301
An improper neutralization of special elements used in an OS Command vulnerability CWE-78 in FortiAP-C console 5.4.0 through 5.4.3, 5.2.0 through 5.2.1 may allow an authenticated attacker to execute unauthorized commands by running CLI commands with specifically crafted arguments...
python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions
A flaw was found in python-pillow. The vulnerability occurs due to Improper Neutralization, leading to command injection. This flaw allows an attacker to externally-influenced input commands that modify the intended command...
CVE-2022-23810
The CVE-2022-23810 issue affects a-blog cms (Appleple) with template injection (Improper Neutralization of Special Elements Used in a Template Engine). A remote authenticated attacker can obtain arbitrary files on the server via unspecified vectors. Affected versions include: 2.8.x before 2.8.75,...
python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions
A flaw was found in python-pillow. The vulnerability occurs due to Improper Neutralization, leading to command injection. This flaw allows an attacker to externally-influenced input commands that modify the intended command...
CVE-2022-25809
CVE-2022-25809 affects Amazon Echo Dot devices (3rd and 4th Gen). Root cause: improper neutralization of audio output enables arbitrary voice command execution via a malicious skill (remote) or by pairing a malicious Bluetooth device (physical proximity) in an Alexa-versus-Alexa (AvA) scenario. I...
CVE-2021-41018
CVE-2021-41018 affects Fortinet FortiWeb OS command injection via improper neutralization of special elements in HTTP requests. Affected are FortiWeb versions 6.4.1 and below, and 6.3.15 and below. The vulnerability can allow an attacker to execute unauthorized code or commands through crafted HT...
Cross-site Scripting (XSS)
productsatcontenttypes is vulnerable to cross-site scripting attacks. The vulnerability exists due to Improper Neutralization in the imageviewfullscreen.pt file allowing an attacker to cache poisoning and redirect URLs to untrusted sites...
Mageia: Security Advisory (MGASA-2021-0259)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
icecoder is vulnerable to Cross-site Scripting
icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
CVE-2022-0323
Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1...
CVE-2022-22817
A flaw was found in python-pillow. The vulnerability occurs due to Improper Neutralization, leading to command injection. This flaw allows an attacker to externally-influenced input commands that modify the intended command...
CVE-2022-0258
pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command...
CVE-2022-0257 Cross-site Scripting (XSS) - Stored in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
CVE-2022-0258 SQL Injection in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command...
UBUNTU-CVE-2022-0224
dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command...
CVE-2022-0224 SQL Injection in dolibarr/dolibarr
dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command...
PT-2022-13044 · Dolibarr · Dolibarr
Name of the Vulnerable Software and Affected Versions: dolibarr affected versions not specified Description: The issue is related to Improper Neutralization of Special Elements used in an SQL Command. This means that the software does not properly handle special characters in SQL commands, which...
Cross site scripting
orchardcore is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...