CVE-2017-17526

Input.cc in Bernard Parisse Giac 1.2.3.57 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17516

scripts/inspectwebbrowser.py in Reddit Terminal Viewer RTV 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17534

Technical details for CVE-2017-17534 are not publicly available in the provided documents. Monitor for updates from vendors and vulnerability databases.

CVE-2017-17520

The CVE-2017-17520 issue affects TIN 2.4.1: tools/url_handler.pl does not validate strings before launching the program specified by the BROWSER environment variable, which can allow remote attackers to perform argument-injection via a crafted URL. This is documented in multiple sources (NVD entr...

CVE-2017-17525

CVE-2017-17525 affects guiclient/guiclient.cpp in xTuple PostBooks 4.7.0, where the BROWSER environment variable is used without validating the launched program’s arguments. This can enable remote argument-injection via a crafted URL. Public records consistently describe the issue and its impact,...

Atlassian Bamboo Multiple Vulnerabilities

Atlassian Bamboo is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:atlassian:bamboo"; if...

PT-2017-14840 · Geometry Center +1 · Geomview +1

Name of the Vulnerable Software and Affected Versions: Geomview version 1.9.5 Description: The issue concerns the common/help.c file in Geomview, which does not validate strings before launching the program specified by the BROWSER environment variable. This might allow remote attackers to conduc...

PT-2017-14829 · White Dune +1 · White Dune +1

Name of the Vulnerable Software and Affected Versions: White dune version 0.30.10 Description: The issue concerns the lack of validation for strings before launching a program specified by the BROWSER environment variable in the swt/motif/browser.c file. This could potentially allow remote...

PT-2017-14837 · Pasdoc · Pasdoc

Name of the Vulnerable Software and Affected Versions: PasDoc version 0.14 Description: The issue concerns the delphi gui/WWWBrowserRunnerDM.pas file in PasDoc 0.14, which does not validate strings before launching the program specified by the BROWSER environment variable. This might allow remote...

PT-2017-14843 · Tkabber · Tkabber

Name of the Vulnerable Software and Affected Versions: Tkabber version 1.1 Description: The issue concerns the default.tcl script in Tkabber, which fails to validate strings before launching a program specified by the BROWSER environment variable. This could potentially allow remote attackers to...

PT-2017-14832 · Fontforge +3 · Fontforge +3

Name of the Vulnerable Software and Affected Versions: FontForge versions prior to 20170731 Description: The issue concerns the uiutil.c component in FontForge, which fails to validate strings before launching a program specified by the BROWSER environment variable. This could potentially allow...

PT-2017-14831 · Tin +2 · Tin +2

Name of the Vulnerable Software and Affected Versions: TIN version 2.4.1 Description: The issue concerns the tools/url handler.pl script in TIN, which does not validate strings before launching the program specified by the BROWSER environment variable. This might allow remote attackers to conduct...

PT-2017-14825 · Vips +2 · Nip2 +2

Name of the Vulnerable Software and Affected Versions: nip2 version 8.4.0 Description: The issue concerns the lack of validation for strings before launching a program specified by the BROWSER environment variable, potentially allowing remote attackers to conduct argument-injection attacks via a...

PT-2017-14826 · Ecmwf +1 · Metview +1

Name of the Vulnerable Software and Affected Versions: Metview version 4.7.3 Description: The issue concerns a lack of validation for strings before launching a program specified by the BROWSER environment variable, potentially allowing remote attackers to conduct argument-injection attacks via a...

CVE-2017-17523

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument...

UBUNTU-CVE-2017-17523

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument...

CVE-2017-17512

sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument...

DEBIAN-CVE-2017-17523

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument...

CVE-2017-17523

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument...

CVE-2017-17523

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument...