100 matches found
CVE-2022-3607 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint
Failure to Sanitize Special Elements into a Different Plane Special Element Injection in GitHub repository octoprint/octoprint prior to 1.8.3...
CVE-2022-3607 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint
Failure to Sanitize Special Elements into a Different Plane Special Element Injection in GitHub repository octoprint/octoprint prior to 1.8.3...
CVE-2022-3607
CVE-2022-3607 affects OctoPrint (octoprint/octoprint) prior to 1.8.3. The root cause is failure to sanitize Special Elements into a different plane (Special Element Injection). According to the data, the vulnerability has a HIGH impact on confidentiality (C) with no availability impact, exploitab...
CVE-2022-3607 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint
Failure to Sanitize Special Elements into a Different Plane Special Element Injection in GitHub repository octoprint/octoprint prior to 1.8.3...
OctoPrint ę³Øå „ę¼ę“
OctoPrint is an application. Provides a fast web interface for controlling consumer 3D printers. A security vulnerability exists in versions prior to OctoPrint 1.8.3. An attacker exploited the vulnerability to cause special elements to be injected...
Exploit for Special Element Injection in Catchethq Catchet
CVE-2021-391...
ALPINE-CVE-2021-42375
An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input...
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in tildeclub/site
āļø Description The file signup-handler.php creates a user by accepting input from request parameters username, email, interest, sshkey. The affected parameter is sshkey. It does not sanitizes special characters and only checks if the first 4 character of the input is ssh- which allows the signup...
GHSA-HWVQ-6GJX-J797 Special Element Injection in notebook
Impact Untrusted notebook can execute code on load. This is a remote code execution, but requires user action to open a notebook. Patches 5.7.11, 6.4.1 References OWASP Page on Injection Prevention For more information If you have any questions or comments about this advisory, or vulnerabilities ...
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in devcode-it/openstamanager
āļø Description A user without access to the software can inject a portion of HTML code in access logs. šµļøāāļø Proof of Concept Simulate login with a crafter Client-IP header like this: curl -H 'Client-IP: INJECT' -d 'username=&password=&op=login' 'http://localhost//?op=login' The result is: š„ Impact...
CVE-2021-32798 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebook
The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim...
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in sebhildebrandt/systeminformation
āļø Description The systeminformation package is vulnerable to Improper Input Validation through versions function. šµļøāāļø Proof of Concept javascript // PoC.js const si = require'systeminformation'; si.versionstoString : = console.log"This is a PoC" ; š„ Impact This vulnerability allows attackers to...
CVE-2016-9471
Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver instance. Especially, control characters were not filtered, allowing apparently identical usernames to co-exist in the system, due to the fa...
Design/Logic Flaw
Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver instance. Especially, control characters were not filtered, allowing apparently identical usernames to co-exist in the system, due to the fa...
CVE-2016-9471
Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver instance. Especially, control characters were not filtered, allowing apparently identical usernames to co-exist in the system, due to the fa...
CVE-2016-9471
The vulnerability CVE-2016-9471 affects Revive Adserver prior to 3.2.5 and 4.0.0, caused by insufficient filtering of usernames during user creation. Specifically, control characters were not filtered, allowing apparently identical usernames to co-exist and enabling potential user spoofing. Explo...
CVE-2016-8017
Special element injection vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows authenticated remote attackers to read files on the webserver via a crafted user input...
CVE-2016-8017
Special element injection vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows authenticated remote attackers to read files on the webserver via a crafted user input...
CVE-2016-8017
Special element injection vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows authenticated remote attackers to read files on the webserver via a crafted user input...
McAfee VirusScan for Linux contains multiple vulnerabilities
Overview McAfee VirusScan for Linux contains multiple vulnerabilities. Description McAfee VirusScan for Linux version 2.0.3 and prior is vulnerable to the following:CWE-200: Information Exposure - CVE-2016-8016 Multiple pages within the web interface utilize a tplt parameter. An authenticated...