CVE-2021-22911

A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE...

CVE-2021-22911

CVE-2021-22911 affects Rocket.Chat 3.11–3.13 and is a NoSQL injection that enables unauthenticated access to an API endpoint, potentially leading to data exposure, modification, or remote code execution. Root cause: NoSQL injection in endpoints such as getPasswordPolicy and users.list, enabling r...

CVE-2021-21506

PowerScale OneFS 8.1.2,8.2.2 and 9.1.0 contains an improper input sanitization issue in its API handler. An un-authtenticated with ISIPRIVSYSSUPPORT and ISIPRIVLOGINPAPI privileges could potentially exploit this vulnerability, leading to potential privileges escalation...

CVE-2021-21503: Improper Neutralization of Special Elements used in an OS Command

PowerScale OneFS 8.1.2,8.2.2 and 9.1.0 contains an improper input sanitization issue in a command. The Compadmin user could potentially exploit this vulnerability, leading to potential privileges escalation...

PT-2021-14565

Name of the Vulnerable Software and Affected Versions PowerScale OneFS versions 8.1.2, 8.2.2, and 9.1.0 Description The issue is related to improper input sanitization in the API handler. An unauthenticated user with ISI PRIV SYS SUPPORT and ISI PRIV LOGIN PAPI privileges could potentially exploi...

CVE-2021-21506: Improper Input Validation

PowerScale OneFS 8.1.2,8.2.2 and 9.1.0 contains an improper input sanitization issue in its API handler. An un-authtenticated with ISIPRIVSYSSUPPORT and ISIPRIVLOGINPAPI privileges could potentially exploit this vulnerability, leading to potential privileges escalation...

PT-2021-14563

Name of the Vulnerable Software and Affected Versions PowerScale OneFS versions 8.1.2, 8.2.2, and 9.1.0 Description The issue is related to improper input sanitization in a command, which could be exploited by the Compadmin user to potentially escalate privileges. Recommendations For PowerScale...

Command injection

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command...

CVE-2020-27159: Improper Neutralization of Special Elements used in an OS Command

Addressed remote code execution vulnerability in DsdkProxy.php due to insufficient sanitization and insufficient validation of user input in Western Digital My Cloud NAS devices prior to 5.04.114...

Crlf injection

A vulnerability in the Clientless SSL VPN WebVPN of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to inject arbitrary HTTP headers in the responses of the affected system. The vulnerability is due to...

CVE-2020-16902: Improper Privilege Management

An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then...

PT-2020-21071

Name of the Vulnerable Software and Affected Versions next versions prior to 5.1.0 Description The issue allows for Remote Code Execution due to improper input sanitization in the /path: route, which passes input to a require call. This enables attackers to execute JavaScript code on the server...

PT-2020-14193

Name of the Vulnerable Software and Affected Versions Fiber versions prior to 1.12.6 Description The issue arises from improper input sanitization in the c.Attachment function, allowing a maliciously constructed filename to inject additional headers into an HTTP response. This can lead to a CRLF...

CVE-2020-1326: Improper Neutralization of Input During Web Page Generation

A Cross-site Scripting XSS vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site Scripting Vulnerability'...

CVE-2020-3212 Cisco IOS XE Software Web UI Command Injection Vulnerability

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device. The vulnerability is due to improper input sanitization. An attacker could exploit this...

PT-2020-2675

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operati...

PT-2020-12232

Name of the Vulnerable Software and Affected Versions Advantech WebAccess/NMS versions prior to 3.0.2 Description The issue is related to the improper sanitization of user input, which may allow an attacker to inject system commands remotely. This could potentially lead to remote code execution...

CVE-2019-1352

A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387...

CVE-2019-1354

A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1352, CVE-2019-1387...

CVE-2019-1350

A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387...