CVE-2017-17533: Improper Neutralization of Special Elements in Output Used by a Downstream Component

default.tcl in Tkabber 1.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has indicated that the attack cannot occur because of th...

CVE-2017-17526: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Input.cc in Bernard Parisse Giac 1.2.3.57 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17517: Improper Neutralization of Special Elements in Output Used by a Downstream Component

libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17515: Improper Neutralization of Special Elements in Output Used by a Downstream Component

etc/ObjectList in Metview 4.7.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has indicated that the code to access this...

PT-2017-14830

Name of the Vulnerable Software and Affected Versions OCaml Batteries Included aka ocaml-batteries version 2.6 Description The issue concerns the batteriesConfig.mlp in OCaml Batteries Included, which fails to validate strings before launching the program specified by the BROWSER environment...

CVE-2017-17518: Improper Neutralization of Special Elements in Output Used by a Downstream Component

swt/motif/browser.c in Whitedune aka whitedune 0.30.10 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: This issue is being disputed as not being ...

PT-2017-14842

Name of the Vulnerable Software and Affected Versions Kiwi version 1.9.22 Description The issue concerns the lack of validation for strings before launching a program specified by the BROWSER environment variable. This could potentially allow remote attackers to conduct argument-injection attacks...

PT-2017-14843 · Tkabber · Tkabber

Name of the Vulnerable Software and Affected Versions: Tkabber version 1.1 Description: The issue concerns the default.tcl script in Tkabber, which fails to validate strings before launching a program specified by the BROWSER environment variable. This could potentially allow remote attackers to...

PT-2017-14824

Name of the Vulnerable Software and Affected Versions TeX Live versions through 20170524 Description The issue is related to the lack of validation of strings before launching the program specified by the BROWSER environment variable. This could allow remote attackers to conduct argument-injectio...

PT-2017-14845

Name of the Vulnerable Software and Affected Versions gjots2 version 2.4.1 Description The issue concerns the lack of validation for strings before launching a program specified by the BROWSER environment variable. This could potentially allow remote attackers to conduct argument-injection attack...

PT-2017-14822

Name of the Vulnerable Software and Affected Versions KildClient version 3.1.0 Description The issue is related to the lack of validation of strings before launching a program specified by the BROWSER environment variable. This could allow remote attackers to conduct argument-injection attacks vi...

PT-2017-14826 · Ecmwf +1 · Metview +1

Name of the Vulnerable Software and Affected Versions: Metview version 4.7.3 Description: The issue concerns a lack of validation for strings before launching a program specified by the BROWSER environment variable, potentially allowing remote attackers to conduct argument-injection attacks via a...

PT-2017-14838

Name of the Vulnerable Software and Affected Versions ScummVM version 1.9.0 Description The issue concerns the failure to validate strings before launching a program specified by the BROWSER environment variable. This could allow remote attackers to conduct argument-injection attacks via a crafte...

CVE-2017-17529: Improper Neutralization of Special Elements in Output Used by a Downstream Component

af/util/xp/utgofile.cpp in AbiWord 3.0.2-2 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

PT-2017-14831 · Tin +2 · Tin +2

Name of the Vulnerable Software and Affected Versions: TIN version 2.4.1 Description: The issue concerns the tools/url handler.pl script in TIN, which does not validate strings before launching the program specified by the BROWSER environment variable. This might allow remote attackers to conduct...

PT-2017-14836

Name of the Vulnerable Software and Affected Versions Giac version 1.2.3.57 Description The issue concerns the failure to validate strings before launching a program specified by the BROWSER environment variable, potentially allowing remote attackers to conduct argument-injection attacks via a...

PT-2017-14825 · Vips +2 · Nip2 +2

Name of the Vulnerable Software and Affected Versions: nip2 version 8.4.0 Description: The issue concerns the lack of validation for strings before launching a program specified by the BROWSER environment variable, potentially allowing remote attackers to conduct argument-injection attacks via a...

CVE-2017-17514: Improper Neutralization of Special Elements in Output Used by a Downstream Component

boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that this product does not use the BROWSER...

PT-2017-14844

Name of the Vulnerable Software and Affected Versions Mensis version 0.0.080507 Description The issue is related to the uiutil.c file in Mensis, which does not validate strings before launching a program specified by the BROWSER environment variable. This could allow remote attackers to conduct...

CVE-2017-17524: Improper Neutralization of Special Elements in Output Used by a Downstream Component

library/wwwbrowser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...