5504 matches found
CVE-2018-16084: Improper Neutralization of Input During Web Page Generation
The default selected dialog button in CustomHandlers in Google Chrome prior to 69.0.3497.81 allowed a remote attacker who convinced the user to perform certain operations to open external programs via a crafted HTML page...
CVE-2019-0244: Improper Neutralization of Input During Web Page Generation
SAP CRM WebClient UI fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...
CVE-2018-8920: Improper Encoding or Escaping of Output
Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager DSM before 6.1.6-15266 allows remote attackers to inject arbitrary content to have an unspecified impact by exporting an archive in CSV format...
CVE-2018-18250: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navigation item...
PT-2018-2172
Name of the Vulnerable Software and Affected Versions Modicon M340, Premium, Quantum PLCs and BMXNOR0200 affected versions not specified Description The issue is related to an improper neutralization of script-related HTML tags in a web page, which can be exploited to execute a password change on...
CVE-2018-8608: Improper Neutralization of Input During Web Page Generation
A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises version 8 does not properly sanitize a specially crafted web request to an affected Dynamics server, aka "Microsoft Dynamics 365 on-premises version 8 Cross Site Scripting Vulnerability." This affects Microsoft...
CVE-2018-19222: Improper Neutralization of Input During Web Page Generation
An issue was discovered in LAOBANCMS 2.0. It allows a /install/mysqlhy.php?riqi=0&i=0 attack to reset the admin password, even if install.txt exists...
CVE-2018-18517: Improper Neutralization of Input During Web Page Generation
Citrix NetScaler Gateway 10.5.x before 10.5.69.003, 11.1.x before 11.1.59.004, 12.0.x before 12.0.58.7, and 12.1.x before 12.1.49.1 has XSS...
CVE-2018-11022: Improper Neutralization of Argument Delimiters in a Command
kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD3rd Fire OS 4.5.5.3 allows attackers to inject a crafted argument via the argument of an ioctl on device /dev/gcioctl with the command 3224132973 and cause a kernel crash...
CVE-2018-8488: Improper Neutralization of Input During Web Page Generation
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint. This CVE ID is unique fr...
CVE-2018-8480: Improper Neutralization of Input During Web Page Generation
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint. This CVE ID is unique fr...
CVE-2018-8518: Improper Neutralization of Input During Web Page Generation
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint. This CVE ID is unique fr...
CVE-2018-2466: Improper Neutralization of Input During Web Page Generation
In Impact and Lineage Analysis in SAP Data Services, version 4.2, the management console does not sufficiently validate user-controlled inputs, which results in Cross-Site Scripting XSS vulnerability...
CVE-2018-2472: Improper Neutralization of Input During Web Page Generation
SAP BusinessObjects Business Intelligence Platform 4.10 and 4.20 Web Intelligence DHTML client does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...
CVE-2018-17830: Improper Neutralization of Input During Web Page Generation
The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted only values are restricted. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=&args substring...
Debian DLA-1520-1 : python3.4 security update
Multiple vulnerabilities were found in the CPython interpreter which can cause denial of service, information gain, and arbitrary code execution. CVE-2017-1000158 CPython aka Python is vulnerable to an integer overflow in the PyStringDecodeEscape function in stringobject.c, resulting in heap-base...
Command injection
Python Software Foundation Python CPython version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in shutil module makearchive function that can result in Denial of service, Information gain via injection of arbitrary files on...
CVE-2018-2464: Improper Neutralization of Input During Web Page Generation
SAP WebDynpro Java, versions 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting XSS vulnerability...
CVE-2018-2452: Improper Neutralization of Input During Web Page Generation
The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting XSS vulnerability...