PT-2017-14843 · Tkabber · Tkabber

Name of the Vulnerable Software and Affected Versions: Tkabber version 1.1 Description: The issue concerns the default.tcl script in Tkabber, which fails to validate strings before launching a program specified by the BROWSER environment variable. This could potentially allow remote attackers to...

PT-2017-14824

Name of the Vulnerable Software and Affected Versions TeX Live versions through 20170524 Description The issue is related to the lack of validation of strings before launching the program specified by the BROWSER environment variable. This could allow remote attackers to conduct argument-injectio...

PT-2017-14838

Name of the Vulnerable Software and Affected Versions ScummVM version 1.9.0 Description The issue concerns the failure to validate strings before launching a program specified by the BROWSER environment variable. This could allow remote attackers to conduct argument-injection attacks via a crafte...

PT-2017-14839

Name of the Vulnerable Software and Affected Versions AbiWord version 3.0.2-2 Description The issue concerns the failure to validate strings before launching a program specified by the BROWSER environment variable. This could allow remote attackers to conduct argument-injection attacks via a...

PT-2017-14836

Name of the Vulnerable Software and Affected Versions Giac version 1.2.3.57 Description The issue concerns the failure to validate strings before launching a program specified by the BROWSER environment variable, potentially allowing remote attackers to conduct argument-injection attacks via a...

PT-2017-14825 · Vips +2 · Nip2 +2

Name of the Vulnerable Software and Affected Versions: nip2 version 8.4.0 Description: The issue concerns the lack of validation for strings before launching a program specified by the BROWSER environment variable, potentially allowing remote attackers to conduct argument-injection attacks via a...

PT-2017-14844

Name of the Vulnerable Software and Affected Versions Mensis version 0.0.080507 Description The issue is related to the uiutil.c file in Mensis, which does not validate strings before launching a program specified by the BROWSER environment variable. This could allow remote attackers to conduct...

PT-2017-14834

Name of the Vulnerable Software and Affected Versions SWI-Prolog version 7.2.3 Description The issue is related to the library/www browser.pl in SWI-Prolog, which does not validate strings before launching the program specified by the BROWSER environment variable. This could allow remote attacker...

CVE-2017-17529: Improper Neutralization of Special Elements in Output Used by a Downstream Component

af/util/xp/utgofile.cpp in AbiWord 3.0.2-2 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17522: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is...

CVE-2017-17517: Improper Neutralization of Special Elements in Output Used by a Downstream Component

libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

PT-2017-14845

Name of the Vulnerable Software and Affected Versions gjots2 version 2.4.1 Description The issue concerns the lack of validation for strings before launching a program specified by the BROWSER environment variable. This could potentially allow remote attackers to conduct argument-injection attack...

CVE-2017-17519: Improper Neutralization of Special Elements in Output Used by a Downstream Component

batteriesConfig.mlp in OCaml Batteries Included aka ocaml-batteries 2.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17520: Improper Neutralization of Special Elements in Output Used by a Downstream Component

tools/urlhandler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has reported that this is intentional behavior,...

CVE-2017-17525: Improper Neutralization of Special Elements in Output Used by a Downstream Component

guiclient/guiclient.cpp in xTuple PostBooks 4.7.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17532: Improper Neutralization of Special Elements in Output Used by a Downstream Component

examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17516: Improper Neutralization of Special Elements in Output Used by a Downstream Component

scripts/inspectwebbrowser.py in Reddit Terminal Viewer RTV 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

PT-2017-14835

Name of the Vulnerable Software and Affected Versions xTuple PostBooks version 4.7.0 Description The issue concerns the guiclient/guiclient.cpp component in xTuple PostBooks, which fails to validate strings before launching a program specified by the BROWSER environment variable. This could...

PT-2017-14826 · Ecmwf +1 · Metview +1

Name of the Vulnerable Software and Affected Versions: Metview version 4.7.3 Description: The issue concerns a lack of validation for strings before launching a program specified by the BROWSER environment variable, potentially allowing remote attackers to conduct argument-injection attacks via a...

CVE-2017-17530: Improper Neutralization of Special Elements in Output Used by a Downstream Component

common/help.c in Geomview 1.9.5 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: this is disputed by a third party because no untrusted input can ...