2323 matches found
CVE-2017-17535
lib/gui.py in Bob Hepple gjots2 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...
CVE-2017-17533
default.tcl in Tkabber 1.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has indicated that the attack cannot occur because of th...
CVE-2017-17534
uiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17521...
DEBIAN-CVE-2017-17530
common/help.c in Geomview 1.9.5 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: this is disputed by a third party because no untrusted input can ...
DEBIAN-CVE-2017-17511
KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to prefs.c and worldgui.c...
UBUNTU-CVE-2017-17517
libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...
UBUNTU-CVE-2017-17511
KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to prefs.c and worldgui.c...
UBUNTU-CVE-2017-17527
DISPUTED delphigui/WWWBrowserRunnerDM.pas in PasDoc 0.14 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer has indicated that...
UBUNTU-CVE-2017-17530
DISPUTED common/help.c in Geomview 1.9.5 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: this is disputed by a third party because no untrusted...
UBUNTU-CVE-2017-17528
backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...
PT-2017-14832 · Fontforge +3 · Fontforge +3
Name of the Vulnerable Software and Affected Versions: FontForge versions prior to 20170731 Description: The issue concerns the uiutil.c component in FontForge, which fails to validate strings before launching a program specified by the BROWSER environment variable. This could potentially allow...
PT-2017-14843 · Tkabber · Tkabber
Name of the Vulnerable Software and Affected Versions: Tkabber version 1.1 Description: The issue concerns the default.tcl script in Tkabber, which fails to validate strings before launching a program specified by the BROWSER environment variable. This could potentially allow remote attackers to...
sensible-utils sensible-browser injection vulnerability
sensible-utils is a toolkit for analyzing and launching appropriate browsers, editors and pagers. sensible-browser is one of the browser selection tools. A security vulnerability exists in sensible-browser in versions of sensible-utils prior to 0.0.11, which stems from an undetected string before...
CVE-2017-12362
A vulnerability in Cisco Meeting Server versions prior to 2.2.2 could allow an authenticated, remote attacker to cause the system to reload, resulting in a denial of service DoS condition. The vulnerability is due to video calls being made on systems with a particular configuration. An attacker...
Multiple Cross-Site Scripting Vulnerabilities in TeamPass
TeamPass is a dedicated password manager for Apache, MySQL and PHP. Multiple cross-site scripting vulnerabilities exist in versions of TeamPass prior to 2.1.27.9. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of an item's URL value or user l...
Horde Groupware Cross-Site Scripting Vulnerability (CNVD-2017-37741)
Horde Groupware is an enterprise browser based on the Communication Suite from Horde USA. The browser supports sending and receiving e-mail, managing and sharing calendars, contacts and tasks, and more. A cross-site scripting vulnerability exists in Horde Groupware version 5.2.19. A remote attack...
Mozilla Firefox Cross-Origin URL Information Disclosure Vulnerability
Mozilla Firefox browser Firefox is a free, open source browser for Windows, Linux and MacOSX platforms. A cross-origin URL information disclosure vulnerability exists in Mozilla Firefox versions prior to 57.0. The vulnerability arises because the Resource Timing API incorrectly discloses navigati...
chromium-browser Omnibox Component URL Spoofing Vulnerability
chromium-browser is an open source web browser project started by Google to provide source code for the proprietary Google Chrome browser. A URL spoofing vulnerability exists in the chromium-browser Omnibox component. An attacker could exploit the vulnerability to conduct malicious website URL...