CVE-2022-4092: Improper Neutralization of Input During Web Page Generation

An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious README page due to improper neutralisation of user supplied input...

CVE-2022-4092

Removed by vendor...

CVE-2015-10062: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A vulnerability, which was classified as problematic, was found in galaxy-data-resource up to 14.10.0. This affects an unknown part of the component Command Line Template. The manipulation leads to injection. Upgrading to version 14.10.1 is able to address this issue. The patch is named...

CVE-2015-10049: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Overdrive Eletrônica course-builder up to 1.7.x and classified as problematic. Affected by this issue is some unknown functionality of the file coursebuilder/modules/oeditor/oeditor.html. The manipulation leads to cross site scripting. The attack may be launched...

Command injection

InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'. An unauthorized user with privileged access to the...

InHand Networks InRouter302 操作系统命令注入漏洞

The InHand Networks InRouter302 is an LTE cellular router from InHand Networks, Inc. An operating system command injection vulnerability exists in the InHand Networks InRouter302 version prior to V3.5.56, and the InRouter615 version prior to V2.3.0.r5542, which stems from improper neutralization ...

CVE-2014-125074: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Nayshlok Voyager. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file Voyager/src/models/DatabaseAccess.java. The manipulation leads to sql injection. The identifier of the patch is...

CVE-2023-0112: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.10.0...

CVE-2015-10027: Improper Neutralization of Special Elements used in an LDAP Query

A vulnerability, which was classified as problematic, has been found in hydrian TTRSS-Auth-LDAP. Affected by this issue is some unknown functionality of the component Username Handler. The manipulation leads to ldap injection. Upgrading to version 2.0b1 is able to address this issue. The patch is...

CVE-2022-39947

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiADC version 7.0.0 through 7.0.2, FortiADC version 6.2.0 through 6.2.3, FortiADC version version 6.1.0 through 6.1.6, FortiADC version 6.0.0 through 6.0.4, FortiADC version 5.4.0 through 5.4...

CVE-2022-37933: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. The vulnerability could be exploited to allow local unauthorized data injection. HPE has made the following software updates to resolve the vulnerability in HPE Superdome Flex firmware...

CVE-2014-125032: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in porpeeranut go-with-me. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file module/frontend/add.php. The manipulation leads to sql injection. The identifier of the patch is b92451e4f9e85e26cf493c95ea0a69e354c35df9. ...

CVE-2022-40956: Improper Neutralization of Input During Web Page Generation

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...

CVE-2022-22748: Improper Neutralization of Input During Web Page Generation

Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol. This vulnerability affects Firefox ESR 91.5, Firefox 96, and Thunderbird 91.5...

CVE-2022-46877: Improper Neutralization of Input During Web Page Generation

By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox 108...

CVE-2022-31743: Improper Neutralization of Input During Web Page Generation

Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. This could have been used to escape HTML comments on pages that put user-controlled data in them. This vulnerability affects Firefox 101...

CVE-2022-38106: Improper Neutralization of Input During Web Page Generation

This vulnerability happens in the web client versions 15.3.0 to Serv-U 15.3.1. This vulnerability affects the directory creation function...

CVE-2022-4407: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9...

CVE-2022-43660

Improper neutralization of Server-Side Includes SSW within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage of Content Types' may execute an arbitrary Perl script and/or an arbitrary OS command. Affected products/versions are as follows: Movable...

CVE-2022-43660

The CVE-2022-43660 issue is an SSI (Server-Side Includes) handling vulnerability in Movable Type and related products. A remote authenticated attacker with the privilege “Manage of Content Types” could execute arbitrary Perl scripts or arbitrary OS commands via a crafted web page. Affected are Mo...