CVE-2018-8149: Improper Neutralization of Input During Web Page Generation

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint Server, Microsoft...

CVE-2018-6021: Improper Neutralization of Special Elements used in an OS Command

Silex SD-320AN version 2.01 and prior and GE MobileLinkGEH-SD-320AN version GEH-1.1 and prior have a system call parameter that is not properly sanitized, which may allow remote code execution...

CVE-2018-8155: Improper Neutralization of Input During Web Page Generation

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint. This CVE ID is unique fr...

The vulnerability of the software-hardware platform for access control in Linear E3 eMerge arises from the improper neutralization of special elements used in the command line. This allows a intruder to elevate their privileges and execute arbitrary code.

The vulnerability of the software-hardware platform for access control in Linear E3 eMerge is related to the improper neutralization of special elements used in the command sequence. Exploiting this vulnerability can allow a malicious actor to enhance their privileges and execute arbitrary code...

Design/Logic Flaw

gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "processheaders" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been...

CVE-2018-1000164

Summary of CVE-2018-1000164 (Gunicorn) : Gunicorn 19.4.5 contains a CWE-113 vulnerability in the process_headers function (gunicorn/http/wsgi.py) that can cause HTTP header splitting to lead to arbitrary HTTP headers being returned by the server. The issue is fixed in version 19.5.0. Documents in...

CVE-2018-1000164

gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "processheaders" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been...

CVE-2017-18259: Improper Neutralization of Input During Web Page Generation

Dolibarr ERP/CRM is affected by stored Cross-Site Scripting XSS in versions through 7.0.0...

CVE-2018-1081: Improper Neutralization of Input During Web Page Generation

A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was...

CVE-2018-9172: Improper Neutralization of Input During Web Page Generation

The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes...

CVE-2018-3740: Improper Neutralization of Input During Web Page Generation

A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element...

CVE-2017-0916: Improper Neutralization of Special Elements used in a Command

Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the systemhookpush queue through web hook component resulting in remote code execution...

CVE-2018-8108: Improper Neutralization of Input During Web Page Generation

The select component in bui through 2018-03-13 has XSS because it performs an escape operation on already-escaped text, as demonstrated by workGroupList text...

CVE-2018-8045: Improper Neutralization of Special Elements used in an SQL Command

In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the User Notes list view...

CVE-2018-2397: Improper Neutralization of Input During Web Page Generation

In SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Management Console CMC does not sufficiently encode user controlled inputs which results in Cross-Site Scripting...

CVE-2018-0923: Improper Neutralization of Input During Web Page Generation

Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0909, CVE-2018-0910. CVE-2018-0911, CVE-2018-0912,...

CVE-2017-15719: Improper Neutralization of Input During Web Page Generation

In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor...

PT-2018-8664

Name of the Vulnerable Software and Affected Versions: Cisco Jabber Client Framework JCF affected versions not specified Description: A security issue in Cisco Jabber Client Framework could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of an...

CVE-2018-0199: Improper Neutralization of Input During Web Page Generation

A vulnerability in Cisco Jabber Client Framework JCF could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of an affected device. The vulnerability is due to improper neutralization of script in attributes in a web page. An attacker could...

CVE-2018-6943: Improper Neutralization of Input During Web Page Generation

core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable...