5499 matches found
CVE-2022-31180: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output. This issue only impacts users that use the escape or escapeAll functions with the interpolation option set to true. The result is that if ...
CVE-2022-22280
Improper Neutralization of Special Elements used in an SQL Command leading to Unauthenticated SQL Injection vulnerability, impacting SonicWall GMS 9.3.1-SP2-Hotfix1, Analytics On-Prem 2.5.0.3-2520 and earlier versions...
CVE-2022-2323
Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remote code execution in the host system. This vulnerability impacts SonicWall Switch 1.1.1.0-2s and earlier versions...
CVE-2022-2323: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remote code execution in the host system. This vulnerability impacts SonicWall Switch 1.1.1.0-2s and earlier versions...
CVE-2021-42535: Improper Neutralization of Input During Web Page Generation
VISAM VBASE version 11.6.0.6 does not neutralize or incorrectly neutralizes user-controllable input before the data is placed in output used as a public-facing webpage...
CVE-2020-28455: Improper Neutralization of Input During Web Page Generation
This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped...
CVE-2020-28438: Improper Neutralization of Special Elements used in a Command
This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js...
CVE-2022-2219: Improper Neutralization of Input During Web Page Generation
The Unyson WordPress plugin before 2.7.27 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...
CVE-2022-22221: Undefined Security Weakness
An Improper Neutralization of Special Elements vulnerability in the download manager of Juniper Networks Junos OS on SRX Series and EX Series allows a locally authenticated attacker with low privileges to take full control over the device. One aspect of this vulnerability is that the attacker nee...
CVE-2022-36322: Improper Neutralization of Argument Delimiters in a Command
In JetBrains TeamCity before 2022.04.2 build parameter injection was possible...
The vulnerability of the Red Database database management system lies in the improper neutralization of equivalent special elements, allowing attackers to provide unreliable data during a search query.
The vulnerability of the RedBase database management system is related to the improper neutralization of equivalent special elements. Exploiting this vulnerability allows an attacker to provide unreliable data during a search using Distinguished Names, by employing special symbols...
Design/Logic Flaw
An improper neutralization of input during web page generation vulnerability CWE-79 in FortiAuthenticator OWA Agent for Microsoft version 2.2 and 2.1 may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests...
The vulnerability of the command-line interface (CLI) implementation of Zyxel networking devices allows a perpetrator to execute arbitrary commands.
The vulnerability of CLI implementations for Zyxel network devices involves the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...
PT-2022-6216
Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS on SRX Series and EX Series versions prior to 19.2R1-S9, 19.2R3-S5 Juniper Networks Junos OS on SRX Series and EX Series version 19.3 prior to 19.3R3-S6 Juniper Networks Junos OS on SRX Series and EX Series version 19...
CVE-2022-33155: Improper Neutralization of Input During Web Page Generation
The ameostarteaucitron aka AMEOS - TarteAuCitron GDPR cookie banner and tracking management / French RGPD compatible extension before 1.2.23 for TYPO3 allows XSS...
CVE-2022-35172: Improper Neutralization of Input During Web Page Generation
SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting XSS vulnerability...
Cross site request forgery (csrf)
Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user...
CVE-2022-2353
Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user...
CVE-2022-31014: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the backend SMTP server. However, the main risk here is that the attacker can then hijack an...