CVE-2019-10149: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in Exim versions 4.87 to 4.91 inclusive. Improper validation of recipient address in delivermessage function in /src/deliver.c may lead to remote command execution...

CVE-2019-11969: Improper Neutralization of Special Elements used in an Expression Language Statement

A remote code execution vulnerability was identified in HPE Intelligent Management Center IMC PLAT earlier than version 7.3 E0506P09...

CVE-2019-5380: Improper Neutralization of Special Elements used in an Expression Language Statement

A remote code execution vulnerability was identified in HPE Intelligent Management Center IMC PLAT earlier than version 7.3 E0506P09...

CVE-2019-5378: Improper Neutralization of Special Elements used in an Expression Language Statement

A remote code execution vulnerability was identified in HPE Intelligent Management Center IMC PLAT earlier than version 7.3 E0506P09...

CVE-2019-11949: Improper Neutralization of Special Elements used in an Expression Language Statement

A remote code execution vulnerability was identified in HPE Intelligent Management Center IMC PLAT earlier than version 7.3 E0506P09...

CVE-2019-3802: Improper Neutralization of Wildcards or Matching Symbols

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

CVE-2018-18631: Improper Neutralization of Input During Web Page Generation

mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS...

CVE-2018-13375

CVE-2018-13375 is an XSS-style vulnerability in Fortinet products where FortiAnalyzer 5.6.0 and earlier and FortiManager 5.6.0 and earlier fail to properly neutralize script-related HTML tags in the DHCP HOSTNAME parameter. An attacker can inject malicious scripts via a DHCP request, and the scri...

CVE-2019-0221: Improper Neutralization of Input During Web Page Generation

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a...

CVE-2018-7829

The CVE-2018-7829 entry affects Schneider Electric Pelco Sarix/Spectra Cameras (Sarix Enhanced and Spectra Enhanced PTZ) with an improper neutralization of special elements in a query that enables an attacker to execute arbitrary OS commands. The ZeroScience ZSL-2017 report details an authenticat...

CVE-2019-0949: Improper Neutralization of Input During Web Page Generation

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0950, CVE-2019-0951...

CVE-2019-0958: Improper Neutralization of Input During Web Page Generation

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0957...

CVE-2019-6562: Improper Neutralization of Input During Web Page Generation

In Philips Tasy EMR, Tasy EMR Versions 3.02.1744 and prior, the software incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users...

CVE-2019-0764: Improper Neutralization of Argument Delimiters in a Command

A tampering vulnerability exists when Microsoft browsers do not properly validate input under specific conditions, aka 'Microsoft Browsers Tampering Vulnerability'...

CVE-2019-0867: Improper Neutralization of Input During Web Page Generation

A Cross-site Scripting XSS vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0866, CVE-2019-0868,...

CVE-2019-0830: Improper Neutralization of Input During Web Page Generation

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2019-0831...

CVE-2018-4153: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An injection issue was addressed with improved validation. This issue affected versions prior to macOS Mojave 10.14...

CVE-2018-4374: Improper Neutralization of Input During Web Page Generation

A logic issue was addressed with improved validation. This issue affected versions prior to iOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8...

CVE-2019-6506: Improper Neutralization of Special Elements used in an SQL Command

SuiteCRM before 7.8.28, 7.9.x and 7.10.x before 7.10.15, and 7.11.x before 7.11.3 allows SQL Injection...

CVE-2018-20807: Improper Neutralization of Input During Web Page Generation

An XSS issue has been found in welcome.cgi in Pulse Secure Pulse Connect Secure PCS 8.1.x before 8.1R12, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 due to one of the URL parameters not being sanitized properly...