PT-2022-28235

Name of the Vulnerable Software and Affected Versions xml2rfc versions prior to 3.12.4 Description The issue allows script elements in SVG sources, which can lead to XSS attacks in HTML output. This impacts websites that publish HTML drafts and RFCs. Recommendations For versions prior to 3.12.4,...

Cisco command-line interface Command Execution

The vulnerability of the command-line interface of Cisco’s software-hardware devices exists because measures are not taken to neutralize the special elements used in the operating system command. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

FANUC ROBOGUIDE path traversal vulnerability

FANUC ROBOGUIDE is a robot simulation software from FANUC, Japan.ROBOGUIDE v9.40083.00.05 and earlier versions have a path traversal vulnerability, which originates from an improper restriction of pathnames to restricted directories. An attacker can exploit this vulnerability using special elemen...

Advanced Content Filter CKEditor Module Policy Bypass

The vulnerability of the Advanced Content Filter WYSIWYG-editor CKEditor is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow an attacker to circumvent existing policies regarding access restrictions for HTML elements...

NSX for vSphere and Cloud Foundation Command Injection

The vulnerability of the NSX for vSphere and Cloud Foundation network virtualization platforms exists due to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability could allow a attacker to execute arbitrary commands...

CVE-2022-26826: Improper Neutralization of Special Elements used in a Command

Windows DNS Server Remote Code Execution Vulnerability...

Adobe Premiere Elements Privilege Escalation

The vulnerability of Adobe Premiere Elements software-related video editing programs lies in the creation of temporary files with insecure resolutions. Exploiting this vulnerability can allow attackers to enhance their privileges...

Google Chrome Confidential Data Access Data Compromise

The vulnerability of Google Chrome relates to improperly implemented security checks for standard elements. Exploiting this vulnerability can allow an attacker, operating remotely, to access confidential data, compromise its integrity, and even cause service interruptions through a specially...

Adobe Premiere Elements Null Pointer DoS

The vulnerability of Adobe Premiere Elements software-related video editing programs is related to the handling of the null pointer. Exploiting this vulnerability can allow an attacker to cause a service failure...

Adobe Premiere Elements Null Pointer DoS

The vulnerability of Adobe Premiere Elements software-related video editing programs is related to the handling of the null pointer. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Adobe Premiere Elements Buffer Overflow

The vulnerability of Adobe Premiere Elements’ video editing software relates to the execution of operations beyond the buffer limits in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code in the context of the current user, using a specially created file...

Google Chrome Microsoft Edge Data Compromise

The vulnerability of Full Screen Mode implementations in Google Chrome and Microsoft Edge is related to improperly implemented security checks for standard elements. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

ZyXEL NBG6816 Armor Z1 CGI Command Execution

The vulnerability of CGI microprogramming system processors in Wi-Fi routers from ZyXEL NBG6816 Armor Z1 and NBG6817 Armor Z2 lies in the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow attackers to execute...

Adobe Photoshop Elements Privilege Escalation

The vulnerability of Adobe Photoshop Elements relates to the creation of temporary files with insecure resolutions. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2021-43474: Improper Neutralization of Special Elements used in a Command

An Access Control vulnerability exists in D-Link DIR-823G REVA1 1.02B05 Lastest via any parameter in the HNAP1 function...

Libelfin Heap Buffer Overflow DoS

The vulnerability of the linetable::linetable function in the ELF and DWARFv4 reading library Libelfin is related to insufficient elimination of special elements in the request. Exploiting this vulnerability allows a malicious actor to trigger a service failure using a specially created ELF file...

Master Elements <= 8.0 - Unauthenticated SQLi

The plugin does not validate and escape the metaids parameter of its removepostmetacondition AJAX action available to both unauthenticated and authenticated users before using it in a SQL statement, leading to an unauthenticated SQL Injection As unauthenticated:...

Master Elements <= 8.0 - Unauthenticated SQLi

The plugin does not validate and escape the metaids parameter of its removepostmetacondition AJAX action available to both unauthenticated and authenticated users before using it in a SQL statement, leading to an unauthenticated SQL Injection PoC As unauthenticated:...

WordPress Master Elements plugin <= 8.0 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress Master Elements plugin versions = 8.0. Solution Deactivate and delete. This plugin has been closed as of March 9, 2022 and is not available for download. This closure is temporary, pending a full review...

libcmm.so Heap Buffer Overflow DoS

The vulnerability in the implementation of the oalsetIp6DefaultRoute function in the libcmm.so module of the TP-Link TL-WR840N ES router’s software lies in the failure to properly handle special elements when processing the ifName argument. Exploiting this vulnerability allows an attacker to...