CVE-2019-0275: Improper Neutralization of Input During Web Page Generation

SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server J2EE-APPS, versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40 and 7.50, does not sufficiently encode user-controlled inputs, which results in cross-site scripting XSS vulnerability...

CVE-2019-0269: Improper Neutralization of Input During Web Page Generation

SAP BusinessObjects Business Intelligence Platform BI Workspace, versions 4.10 and 4.20, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2019-9714: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Joomla! before 3.9.4. The media form field lacks escaping, leading to XSS...

CVE-2019-0743: Improper Neutralization of Input During Web Page Generation

A Cross-site Scripting XSS vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0742...

CVE-2019-5916: Improper Neutralization of Special Elements used in an Expression Language Statement

Input validation issue in POWER EGGVer 2.0.1, Ver 2.02 Patch 3 and earlier, Ver 2.1 Patch 4 and earlier, Ver 2.2 Patch 7 and earlier, Ver 2.3 Patch 9 and earlier, Ver 2.4 Patch 13 and earlier, Ver 2.5 Patch 12 and earlier, Ver 2.6 Patch 8 and earlier, Ver 2.7 Patch 6 and earlier, Ver 2.7 Governme...

CVE-2019-7740: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Joomla! before 3.9.3. Inadequate parameter handling in JavaScript code core.js writeDynaList could lead to an XSS attack vector...

CVE-2019-1677: Improper Neutralization of Input During Web Page Generation

A vulnerability in Cisco Webex Meetings for Android could allow an unauthenticated, local attacker to perform a cross-site scripting attack against the application. The vulnerability is due to insufficient validation of the application input parameters. An attacker could exploit this vulnerabilit...

CVE-2018-18992: Improper Neutralization of Special Elements in Output Used by a Downstream Component

LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper sanitation, which may allow an attacker to execute remote code on the server...

CVE-2018-18996: Improper Neutralization of Special Elements in Output Used by a Downstream Component

LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an attacker to execute remote code on the server...

CVE-2019-0624: Improper Neutralization of Input During Web Page Generation

A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype for Business 2015 Spoofing Vulnerability." This affects Skype...

CVE-2019-6261: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in comcontact leads to a stored XSS vulnerability...

CVE-2019-2413: Improper Neutralization of Input During Web Page Generation

Vulnerability in the Oracle Reports Developer component of Oracle Fusion Middleware subcomponent: Valid Session. The supported version that is affected is 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer...

CVE-2019-6264: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in modbanners leads to a stored XSS vulnerability...

PYSEC-2019-17

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.pagenotfound, leading to content spoofing in a 404 error page if a user fails to recognize th...

PYSEC-2019-87

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.pagenotfound, leading to content spoofing in a 404 error page if a user fails to recognize th...

Spoofing

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.pagenotfound, leading to content spoofing in a 404 error page if a user fails to recognize th...

CVE-2018-16084: Improper Neutralization of Input During Web Page Generation

The default selected dialog button in CustomHandlers in Google Chrome prior to 69.0.3497.81 allowed a remote attacker who convinced the user to perform certain operations to open external programs via a crafted HTML page...

CVE-2019-3498: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.pagenotfound, leading to content spoofing in a 404 error page if a user fails to recognize th...

CVE-2019-0244: Improper Neutralization of Input During Web Page Generation

SAP CRM WebClient UI fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2018-8920: Improper Encoding or Escaping of Output

Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager DSM before 6.1.6-15266 allows remote attackers to inject arbitrary content to have an unspecified impact by exporting an archive in CSV format...