CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) (page 45)
Page 45 of 51 — CVEs classified under CWE-74, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36084 | Critical | 9.9 | 2022-09-08 | cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versi… |
CVE-2022-37108 | High | 8.7 | 2022-09-07 | An injection vulnerability in the syslog-ng configuration wizard in Securonix Snypr 6.4 allows an application user with the "Manage Ingesters" permission to ex… |
CVE-2022-37242 | Critical | 9.8 | 2022-08-25 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2, is vulnerable to HTTP Response splitting via the data parameter. |
CVE-2022-37240 | Critical | 9.8 | 2022-08-25 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to HTTP Response splitting via the format parameter. |
CVE-2022-34773 | Medium | 4.9 | 2022-08-22 | Tabit - HTTP Method manipulation. https://bridge.tabit.cloud/configuration/addresses-query - can be POST-ed to add addresses to the DB. This is an example of O… |
CVE-2022-32453 | Medium | 6.5 | 2022-08-18 | HTTP header injection vulnerability in Cybozu Office 10.0.0 to 10.8.5 may allow a remote attacker to obtain and/or alter the data of the product via unspecifie… |
CVE-2022-38357 | High | 8.8 | 2022-08-15 | Improper neutralization of special elements leaves the Eyes of Network Web application vulnerable to an iFrame injection attack, via the url parameter of /modu… |
CVE-2022-38191 | Medium | 6.1 | 2022-08-15 | There is an HTML injection issue in Esri Portal for ArcGIS versions 10.9.0 and below which may allow a remote, authenticated attacker to inject HTML into some… |
CVE-2022-35954 | Medium | 5.0 | 2022-08-15 | The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The `core.exportVariable` function uses a well known delimiter that atta… |
CVE-2022-35948 | Medium | 5.3 | 2022-08-15 | undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized inp… |
CVE-2022-36323 | Critical | 9.1 | 2022-08-10 | Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or s… |
CVE-2022-31665 | High | 7.2 | 2022-08-05 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with administrator and n… |
CVE-2022-31658 | High | 7.2 | 2022-08-05 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with administrator and n… |
CVE-2022-35735 | High | 7.2 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, an authenticated attacker with Resource… |
CVE-2022-31181 | Critical | 9.8 | 2022-08-01 | PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which ca… |
CVE-2022-31180 | Critical | 9.8 | 2022-08-01 | Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output… |
CVE-2022-31179 | High | 8.1 | 2022-08-01 | Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. This impacts users tha… |
CVE-2022-36302 | High | 8.8 | 2022-08-01 | File path manipulation vulnerability in BF-OS version 3.00 up to and including 3.83 allows an attacker to modify the file path to access different resources, w… |
CVE-2021-40336 | Medium | 5.0 | 2022-07-25 | A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitti… |
CVE-2016-15004 | High | 7.3 | 2022-07-23 | A vulnerability was found in InfiniteWP Client Plugin 1.5.1.3/1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2022-22360 | High | 8.8 | 2022-07-19 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to conduct an LDAP injection. By using a sp… |
CVE-2021-39028 | Medium | 5.4 | 2022-07-14 | IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTTP header injection, caused by improper validation… |
CVE-2022-31593 | High | 8.8 | 2022-07-12 | SAP Business One client - version 10.0 allows an attacker with low privileges, to inject code that can be executed by the application. An attacker could thereb… |
CVE-2021-36668 | High | 7.8 | 2022-07-12 | URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port parameter to the Electron App. |
CVE-2022-34466 | Medium | 6.5 | 2022-07-12 | A vulnerability has been identified in Mendix Applications using Mendix 9 (All versions >= V9.11 < V9.15), Mendix Applications using Mendix 9 (V9.12) (All vers… |
CVE-2022-34914 | Critical | 9.8 | 2022-07-08 | Webswing before 22.1.3 allows X-Forwarded-For header injection. The client IP address is associated with a variable in the configuration page. The {clientIp} v… |
CVE-2022-33011 | High | 8.8 | 2022-07-08 | Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover via a host header injection attack. |
CVE-2022-31126 | Critical | 10.0 | 2022-07-06 | Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated… |
CVE-2022-31014 | Medium | 5.4 | 2022-07-05 | Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on w… |
CVE-2022-34903 | Medium | 6.5 | 2022-07-01 | GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of G… |
CVE-2013-4144 | Critical | 9.8 | 2022-06-30 | There is an object injection vulnerability in swfupload plugin for wordpress. |
CVE-2022-31108 | Medium | 4.1 | 2022-06-28 | Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams… |
CVE-2022-31088 | Medium | 5.3 | 2022-06-27 | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the… |
CVE-2022-31087 | High | 7.8 | 2022-06-27 | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the… |
CVE-2022-31086 | High | 8.8 | 2022-06-27 | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 inco… |
CVE-2022-25167 | Critical | 9.8 | 2022-06-14 | Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data s… |
CVE-2020-36531 | Medium | 6.3 | 2022-06-07 | A vulnerability, which was classified as critical, has been found in SevOne Network Management System up to 5.7.2.22. This issue affects the Device Manager Pag… |
CVE-2022-29631 | High | 7.5 | 2022-06-06 | Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send… |
CVE-2020-28246 | Critical | 9.8 | 2022-06-02 | A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL… |
CVE-2022-30991 | Medium | 6.1 | 2022-05-18 | HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240 |
CVE-2022-23068 | Medium | 5.4 | 2022-05-18 | ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while… |
CVE-2022-22975 | Medium | 6.6 | 2022-05-11 | An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack would involve the m… |
CVE-2022-29171 | Medium | 6.6 | 2022-05-06 | Sourcegraph is a fast and featureful code search and navigation engine. Versions before 3.38.0 are vulnerable to Remote Code Execution in the gitserver service… |
CVE-2022-29166 | High | 8.0 | 2022-05-05 | matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC comma… |
CVE-2022-23064 | High | 8.8 | 2022-05-02 | In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, i… |
CVE-2022-29816 | Low | 2.8 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible |
CVE-2022-24888 | Medium | 4.3 | 2022-04-27 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1, it is… |
CVE-2022-27924 | High | 7.5 | 2022-04-21 | Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache… |
CVE-2022-20693 | Medium | 4.7 | 2022-04-15 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected… |
CVE-2022-28345 | High | 7.5 | 2022-04-15 | The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs beginning with a non-breaking space, when t… |
CVE-2022-24838 | Medium | 5.3 | 2022-04-11 | Nextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointment Emails via Newlines: as newlines and special ch… |
CVE-2022-24832 | High | 8.2 | 2022-04-11 | GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape specia… |
CVE-2021-22055 | Medium | 5.3 | 2022-04-11 | The SchedulerServer in Vmware photon allows remote attackers to inject logs through \r in the package parameter. Attackers can also insert malicious data and f… |
CVE-2022-1287 | Medium | 6.5 | 2022-04-09 | A vulnerability classified as critical was found in School Club Application System 1.0. This vulnerability affects a request to the file /scas/classes/Users.ph… |
CVE-2022-1074 | Medium | 4.3 | 2022-03-29 | A vulnerability has been found in TEM FLEX-1085 1.6.0 and classified as problematic. Using the input <h1>HTML Injection</h1> in the WiFi settings of the dashbo… |
CVE-2022-25420 | Critical | 9.8 | 2022-03-29 | NTT Resonant Incorporated goo blog App Web Application 1.0 is vulnerable to CLRF injection. This vulnerability allows attackers to execute arbitrary code via a… |
CVE-2022-26205 | Critical | 9.8 | 2022-03-27 | Marky commit 3686565726c65756e was discovered to contain a remote code execution (RCE) vulnerability via the Display text fields. This vulnerability allows att… |
CVE-2022-20001 | High | 7.8 | 2022-03-14 | fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository c… |
CVE-2022-22344 | Medium | 6.1 | 2022-03-14 | IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers… |
CVE-2022-24760 | Critical | 10.0 | 2022-03-12 | Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This… |
CVE-2021-41282 | High | 8.8 | 2022-03-01 | diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The… |
CVE-2022-23701 | Medium | 5.3 | 2022-02-24 | A potential remote host header injection security vulnerability has been identified in HPE Integrated Lights-Out 4 (iLO 4) firmware version(s): Prior to 2.60… |
CVE-2021-44550 | Critical | 9.8 | 2022-02-24 | An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159). |
CVE-2022-21705 | High | 7.2 | 2022-02-23 | Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An au… |
CVE-2022-25337 | Critical | 9.8 | 2022-02-18 | Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows injection attacks via image filenames. |
CVE-2022-0391 | High | 7.5 | 2022-02-09 | A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The is… |
CVE-2022-23616 | High | 8.8 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for an unprivileged… |
CVE-2021-43929 | Medium | 6.5 | 2022-02-07 | Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work flow management in Synology DiskStatio… |
CVE-2022-23614 | High | 8.8 | 2022-02-04 | Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being… |
CVE-2020-12965 | High | 7.5 | 2022-02-04 | When combined with specific software sequences, AMD CPUs may transiently execute non-canonical loads and store using only the lower 48 address bits potentially… |
CVE-2021-36348 | High | 8.1 | 2022-01-25 | iDRAC9 versions prior to 5.00.20.00 contain an input injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit… |
CVE-2021-39031 | High | 8.8 | 2022-01-25 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to conduct an LDAP injection. By using a speci… |
CVE-2021-44537 | High | 7.8 | 2022-01-15 | ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code execution. |
CVE-2021-44530 | Critical | 9.8 | 2022-01-14 | An injection vulnerability exists in a third-party library used in UniFi Network Version 6.5.53 and earlier (Log4J CVE-2021-44228) allows a malicious actor to… |
CVE-2021-32650 | High | 8.8 | 2022-01-14 | October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with… |
CVE-2021-32649 | High | 8.8 | 2022-01-14 | October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with… |
CVE-2021-42561 | High | 8.8 | 2022-01-12 | An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name parameter to a python "os.system" function. This allows… |
CVE-2021-29454 | High | 8.1 | 2022-01-10 | Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, templat… |
CVE-2021-24948 | High | 7.5 | 2022-01-10 | The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJAX action, which co… |
CVE-2022-21663 | Medium | 6.6 | 2022-01-06 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role ca… |
CVE-2021-43852 | High | 8.8 | 2022-01-04 | OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into exist… |
CVE-2021-25994 | High | 8.8 | 2022-01-03 | In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated… |
CVE-2021-45818 | Medium | 6.1 | 2021-12-30 | SAFARI Montage 8.7.32 is affected by a CRLF injection vulnerability which can lead to HTTP response splitting. |
CVE-2021-44832 | Medium | 6.6 | 2021-12-28 | Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when… |
CVE-2021-45661 | High | 7.1 | 2021-12-26 | Certain NETGEAR devices are affected by server-side injection. This affects RBK40 before 2.5.1.16, RBR40 before 2.5.1.16, RBS40 before 2.5.1.16, RBK20 before 2… |
CVE-2021-45660 | High | 7.1 | 2021-12-26 | Certain NETGEAR devices are affected by server-side injection. This affects RBK40 before 2.5.1.16, RBR40 before 2.5.1.16, RBS40 before 2.5.1.16, RBK20 before 2… |
CVE-2021-45659 | High | 7.1 | 2021-12-26 | Certain NETGEAR devices are affected by server-side injection. This affects RBK40 before 2.5.1.16, RBR40 before 2.5.1.16, RBS40 before 2.5.1.16, RBK20 before 2… |
CVE-2021-45658 | High | 7.1 | 2021-12-26 | Certain NETGEAR devices are affected by server-side injection. This affects D7800 before 1.0.1.58, DM200 before 1.0.0.66, EX2700 before 1.0.1.56, EX6150v2 befo… |
CVE-2021-45657 | High | 7.1 | 2021-12-26 | Certain NETGEAR devices are affected by server-side injection. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, R6020 before 1.0.0.48, R6080 before… |
CVE-2021-45656 | High | 7.1 | 2021-12-26 | Certain NETGEAR devices are affected by server-side injection. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, R6020 before 1.0.0.48, R6080 before… |
CVE-2021-45655 | Medium | 6.9 | 2021-12-26 | NETGEAR R6400 devices before 1.0.1.70 are affected by server-side injection. |
CVE-2021-43437 | High | 8.8 | 2021-12-20 | In sourcecodetester Engineers Online Portal as of 10-21-21, an attacker can manipulate the Host header as seen by the web application and cause the application… |
CVE-2021-32499 | High | 7.5 | 2021-12-17 | SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the command line arguments to pass in any value to the Emulator executable. |
CVE-2020-35213 | High | 8.1 | 2021-12-16 | An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false link event messages sent to a master ONOS node. |
CVE-2021-43837 | High | 8.4 | 2021-12-16 | vault-cli is a configurable command-line interface tool (and python library) to interact with Hashicorp Vault. In versions before 3.0.0 vault-cli features the… |
CVE-2021-37262 | High | 7.5 | 2021-12-16 | JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service. |
CVE-2021-43782 | Medium | 6.7 | 2021-12-15 | Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. This is a follow up to GHSA-887w-pv2r-x8pm/CVE-2021-… |
CVE-2021-41276 | Medium | 6.7 | 2021-12-15 | Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize proper… |
CVE-2021-43818 | High | 8.2 | 2021-12-13 | lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content… |
CVE-2021-43038 | High | 8.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The wguest account could execute commands by injecting into PostgreSQL trigger func… |