CVE-2017-7987: Improper Neutralization of Input During Web Page Generation

In Joomla! 3.2.0 through 3.6.5 fixed in 3.7.0, inadequate escaping of file and folder names leads to XSS vulnerabilities in the template manager component...

ALPINE-CVE-2016-10045

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOT...

RHEL 4 / 5 : system-config-printer (RHSA-2011:1196)

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1196 advisory. system-config-printer is a print queue configuration tool with a graphical user interface. It was found that system-config-printer did not proper...

ASP.NET vulnerable to cross-site scripting

Overview ASP.NET contains a cross-site scripting vulnerability. ASP.NET contains an issue in the escape processes for string output. Web applications that use ASP.NET may contain a cross-site scripting vulnerability. Masato Anzai of Mitsui Bussan Secure Directions, Inc. reported this vulnerabilit...

CVE-2009-1714

Cross-site scripting XSS vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to the improper escaping of HTML attributes...

CVE-2009-1714

Cross-site scripting XSS vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to the improper escaping of HTML attributes...

vim: arbitrary code execution in commands: K, Control-], g]

Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to 1 execute arbitrary shell commands by entering a K keystroke on a line that contains a ";" semicolon followed by a command, or execute arbitrary Ex commands by entering an argument afte...

p5-UI-Dialog -- shell command execution vulnerability

Matthijs Kooijman reports: It seems that the whiptail, cdialog and kdialog backends apply some improper escaping in their shell commands, causing special characters present in menu item titles to be interpreted by the shell. This includes the backtick evaluation operator, so this constitutes a...

konversation -- shell script command injection

Konversation comes with Perl scripts that do not properly escape shell characters on executing a script. This makes it possible to attack Konversation with shell script command injection...

PT-2005-1130

Name of the Vulnerable Software and Affected Versions Mailman versions prior to 2.1.5 Description A cross-site scripting XSS issue exists due to improper escaping of URLs in error pages, allowing remote attackers to inject arbitrary web script or HTML. Recommendations For versions prior to 2.1.5,...