CVE-2018-9172: Improper Neutralization of Input During Web Page Generation

The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes...

CVE-2018-3740: Improper Neutralization of Input During Web Page Generation

A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element...

CVE-2017-0916: Improper Neutralization of Special Elements used in a Command

Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the systemhookpush queue through web hook component resulting in remote code execution...

CVE-2018-0923: Improper Neutralization of Input During Web Page Generation

Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0909, CVE-2018-0910. CVE-2018-0911, CVE-2018-0912,...

CVE-2018-2397: Improper Neutralization of Input During Web Page Generation

In SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Management Console CMC does not sufficiently encode user controlled inputs which results in Cross-Site Scripting...

CVE-2018-8108: Improper Neutralization of Input During Web Page Generation

The select component in bui through 2018-03-13 has XSS because it performs an escape operation on already-escaped text, as demonstrated by workGroupList text...

CVE-2018-8045: Improper Neutralization of Special Elements used in an SQL Command

In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the User Notes list view...

CVE-2017-15719: Improper Neutralization of Input During Web Page Generation

In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor...

CVE-2018-0199: Improper Neutralization of Input During Web Page Generation

A vulnerability in Cisco Jabber Client Framework JCF could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of an affected device. The vulnerability is due to improper neutralization of script in attributes in a web page. An attacker could...

CVE-2018-6943: Improper Neutralization of Input During Web Page Generation

core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable...

CVE-2017-5798: Improper Neutralization of Input During Web Page Generation

A Remote Code Execution vulnerability in HPE OpenCall Media Platform OCMP was found. The vulnerability impacts OCMP versions prior to 3.4.2 RP201 for OCMP 3.x, all versions prior to 4.4.7 RP702 for OCMP 4.x...

CVE-2017-5799: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A Remote Code Execution vulnerability in HPE OpenCall Media Platform OCMP was found. The vulnerability impacts OCMP versions prior to 3.4.2 RP201 for OCMP 3.x, all versions prior to 4.4.7 RP702 for OCMP 4.x...

Command injection

Security Onion Solutions Squert version 1.0.1 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in .inc/callback.php that can result in execution of OS Commands. This attack appear to be exploitable via Web reques...

CVE-2018-6380: Improper Neutralization of Input During Web Page Generation

In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the module system...

CVE-2018-6376: Improper Neutralization of Special Elements used in an SQL Command

In Joomla! before 3.8.4, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Hathor postinstall message...

CVE-2018-5443: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection issue was discovered in Advantech WebAccess/SCADA versions prior to V8.220170817. WebAccess/SCADA does not properly sanitize its inputs for SQL commands...

Sql injection

A SQL Injection issue was discovered in Moxa SoftCMS Live Viewer through 1.6. An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability has been identified. Attackers can exploit this vulnerability to access SoftCMS without knowing the user's password...

CVE-2016-0324: Improper Neutralization of Special Elements used in a Command

IBM Security Identity Manager ISIM Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote authenticated users to execute arbitrary code with administrator privileges via unspecified vectors. IBM X-Force ID: 111640...

CVE-2017-16716: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection issue was discovered in WebAccess versions prior to 8.3. WebAccess does not properly sanitize its inputs for SQL commands...

CVE-2017-15714: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code "format=%27;alert%27xss%27" to the URL an alert window would execute...