CVE-2022-3365

Due to reliance on a trivial substitution cipher, sent in cleartext, and the reliance on a default password when the user does not set a password, the Remote Mouse Server by Emote Interactive can be abused by attackers to inject OS commands over theproduct's custom control protocol. A Metasploit...

CVE-2020-7489

A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability exists on EcoStruxure Machine Expert – Basic or SoMachine Basic programming software versions in security notification. The result of this vulnerability, DLL substitution, coul...

CVE-2019-13467

Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle attacks when the applications download resources from the Dashboard web service. This vulnerability may allow an attacker to substitute...

CVE-2016-5431

The PHP JOSE Library by Gree Inc. before version 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the signature verification via crafted tokens...

CVE-2011-3685

Tembria Server Monitor before 6.0.5 Build 2252 uses a substitution cipher to encrypt application credentials, which allows local users to obtain sensitive information by leveraging read access to 1 authentication.dat or 2 XML files in the Exports directory...

CVE-2010-2011

Microsoft Dynamics GP uses a substitution cipher to encrypt the system password field and unspecified other fields, which makes it easier for remote authenticated users to obtain sensitive information by decrypting a field's contents...

CVE-2023-45160

In the affected version of the 1E Client, an ordinary user could subvert downloaded instruction resource files, e.g., to substitute a harmful script. by replacing a resource script file created by an instruction at run time with a malicious script. The 1E Client's temporary directory is now locke...

GHSA-CJ5W-8MJF-R5F8 jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"

Overview On many platforms, a third party can create a Git repository under a name that includes a shell command substitution ^1 string in the syntax $. These directory names are allowed in macOS and a majority of Linux distributions ^2. If a user starts jupyter-lab in a parent directory of this...

CVE-2025-30370 jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"

jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $. These directory names are allowed in macOS and a majority of Linux distributions. If...

jupyterlab-git 安全漏洞

jupyterlab-git is an open source Git extension for JupyterLab. A security vulnerability exists in jupyterlab-git that stems from a command injection that can be caused when a command substitution string is included in a directory name...

The vulnerability of the Mozilla Firefox browser, related to errors in information representation by the user interface, allows a hacker to replace the address bar.

The vulnerability of the Mozilla Firefox browser is related to errors in information representation by the user interface. Exploiting this vulnerability allows a malicious actor to substitute the address bar with a specially created link...

Linux Distros Unpatched Vulnerability : CVE-2023-49284

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish shell uses certain Unicode non-characters internally for...

DOM Expressions 安全漏洞

DOM Expressions is a fine-grained runtime for high-performance DOM rendering by Ryan Carniato Personal Developer. A security vulnerability exists in DOM Expressions that stems from mishandling of substitution patterns and could lead to a cross-site scripting attack...

CVE-2024-28236

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string...

The vulnerability of the Payments component in Google Chrome and Microsoft Edge allows a hacker to bypass existing security restrictions and perform a substitution of the user interface.

The vulnerability of the Payments component in Google Chrome and Microsoft Edge involves exploiting authentication bypass techniques. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions and replace the user interface with a specially created HTML pa...

The vulnerability of GUE tunneling protocols, related to insufficient verification of the communication channel source, allows attackers to execute attacks such as “substitution of the trusted object”.

The vulnerability of GUE tunneling protocols lies in insufficient verification of the source of the communication channel. Exploiting this vulnerability allows a malicious actor to execute attacks such as “substitution of the trusted object” by sending a specially crafted packet containing two IP...

The vulnerability of packet tunneling protocols for IPv4-to-IPv6 and IPv6-to-IPv4 protocols arises from insufficient checks on the source of the communication channel. This allows attackers to execute attacks such as “spoofing of trusted objects”.

The vulnerability of IPv4-to-Ipv6 and IPv6-to-Ipv4 tunneling protocols is related to insufficient checks on the source of the communication channel. Exploiting this vulnerability allows a remote attacker to execute “host object substitution” attacks by sending a specially crafted packet with two ...

The vulnerabilities of the GRE and GRE6 tunneling protocols, related to insufficient source checking of the communication channel, allow attackers to execute attacks such as “spoofing of trusted objects”.

The vulnerabilities of the tunneling protocols GRE and GRE6 are related to insufficient verification of the source of the communication channel. Exploiting these vulnerabilities allows a malicious actor to carry out “host substitution” attacks by sending a specially crafted packet with two IP...

The vulnerability of packet tunneling protocols for IPv4-to-IPv6 and IPv6-to-IPv4 protocols arises from insufficient checks on the source of the communication channel. This allows attackers to execute attacks such as “spoofing of trusted objects”.

The vulnerability of IPv4-to-Ipv6 and IPv6-to-Ipv4 tunneling protocols is related to insufficient checks on the source of the communication channel. Exploiting this vulnerability allows a remote attacker to execute “host object substitution” attacks by sending a specially crafted packet with two ...

CVE-2024-51448

CVE-2024-51448 affects IBM Robotic Process Automation versions 21.0.0–21.0.7.17 and 23.0.0–23.0.18. The root cause is insecure inherited permissions: all install files inherit the parent directory’s permissions, allowing a non-privileged user to substitute any executable for the nssm.exe service....