CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) (page 48)
Page 48 of 51 — CVEs classified under CWE-74, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15953 | High | 7.4 | 2020-07-27 | LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server… |
CVE-2020-15111 | Medium | 4.2 | 2020-07-20 | In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable… |
CVE-2020-14928 | Medium | 5.9 | 2020-07-17 | evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads add… |
CVE-2020-14505 | Critical | 9.8 | 2020-07-15 | Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection”) vulnerability. Successful e… |
CVE-2020-5246 | High | 7.7 | 2020-07-14 | Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability. It occurs when user input is being used in LDAP search filter. By providing… |
CVE-2020-9376 | High | 7.5 | 2020-07-09 | D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. NOTE: This vulnerability only affects produ… |
CVE-2020-11994 | High | 7.5 | 2020-07-08 | Server-Side Template Injection and arbitrary file disclosure on Camel templating components |
CVE-2020-12736 | High | 7.2 | 2020-07-07 | Code42 environments with on-premises server versions 7.0.4 and earlier allow for possible remote code execution. When an administrator creates a local (non-SSO… |
CVE-2020-4027 | Medium | 4.7 | 2020-07-01 | Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template in… |
CVE-2020-10753 | Medium | 5.4 | 2020-06-26 | A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHead… |
CVE-2018-21268 | Critical | 10.0 | 2020-06-25 | The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.ex… |
CVE-2020-15011 | Medium | 4.3 | 2020-06-24 | GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page. |
CVE-2019-20409 | Critical | 9.8 | 2020-06-23 | The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code exec… |
CVE-2020-14954 | Medium | 5.9 | 2020-06-21 | Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response… |
CVE-2020-13262 | Medium | 6.1 | 2020-06-19 | Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on b… |
CVE-2016-11068 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection. |
CVE-2020-9495 | Medium | 5.3 | 2020-06-19 | Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by… |
CVE-2017-18900 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows CSV injection via a compliance report. |
CVE-2018-21258 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invite_people slash command. |
CVE-2020-13445 | High | 8.8 | 2020-06-10 | In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict us… |
CVE-2019-16385 | Medium | 6.1 | 2020-06-04 | Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request, as demonstrated by an example.pdf?m… |
CVE-2020-11078 | Medium | 6.8 | 2020-05-20 | In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send addi… |
CVE-2020-5574 | Medium | 5.3 | 2020-05-14 | HTML attribute value injection vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606… |
CVE-2020-11060 | High | 7.4 | 2020-05-12 | In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an att… |
CVE-2020-6245 | Medium | 6.7 | 2020-05-12 | SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed… |
CVE-2020-12790 | High | 7.5 | 2020-05-11 | In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection an… |
CVE-2020-11056 | High | 7.4 | 2020-05-07 | In Sprout Forms before 3.9.0, there is a potential Server-Side Template Injection vulnerability when using custom fields in Notification Emails which could lea… |
CVE-2020-3246 | Medium | 4.3 | 2020-05-06 | A vulnerability in the web server of Cisco Umbrella could allow an unauthenticated, remote attacker to perform a carriage return line feed (CRLF) injection att… |
CVE-2020-12108 | Medium | 6.5 | 2020-05-06 | /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection. |
CVE-2020-5336 | Medium | 4.6 | 2020-05-04 | RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL injection vulnerability. An unauthenticated attacker could potentially exploit this vulnerability… |
CVE-2019-13285 | High | 7.5 | 2020-05-04 | CoSoSys Endpoint Protector 5.1.0.2 allows Host Header Injection. |
CVE-2020-1961 | Critical | 9.8 | 2020-05-04 | Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling at… |
CVE-2019-12425 | High | 7.5 | 2020-04-30 | Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host |
CVE-2017-18860 | High | 7.7 | 2020-04-29 | Certain NETGEAR devices are affected by debugging command execution. This affects FS752TP 5.4.2.19 and earlier, GS108Tv2 5.4.2.29 and earlier, GS110TP 5.4.2.29… |
CVE-2017-18856 | Medium | 6.7 | 2020-04-29 | NETGEAR ReadyNAS devices before 6.6.1 are affected by command injection. |
CVE-2017-18855 | High | 8.8 | 2020-04-29 | NETGEAR WNR854T devices before 1.5.2 are affected by command execution. |
CVE-2017-18854 | Medium | 6.7 | 2020-04-29 | NETGEAR ReadyNAS 6.6.1 and earlier is affected by command injection. |
CVE-2020-8478 | Medium | 5.3 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA products OPC Server for AC 800M, MMS Server for AC 800M and Base Softw… |
CVE-2018-21208 | High | 8.8 | 2020-04-28 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D6100 before 1.0.0.57, R6100 before 1.0.1.20, R7500v2 be… |
CVE-2017-18863 | High | 7.1 | 2020-04-28 | Certain NETGEAR devices are affected by command execution via a PHP form. This affects WN604 3.3.3 and earlier, WNAP210v2 3.5.20.0 and earlier, WNAP320 3.5.20… |
CVE-2018-21228 | Medium | 6.8 | 2020-04-24 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.34, EX6100v2 before 1.0.1.50, EX6150v2 befo… |
CVE-2018-21227 | Medium | 6.8 | 2020-04-24 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.34, R6400v2 before 1.0.2.34, R6700 before 1… |
CVE-2017-18737 | High | 8.8 | 2020-04-23 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects JNR1010v2 before 1.1.0.44, JR6150 before 1.0.1.10, JWNR2… |
CVE-2017-18736 | High | 8.8 | 2020-04-23 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects JR6150 before 1.0.1.10, R6050 before 1.0.1.10, R6220 bef… |
CVE-2017-18735 | High | 8.8 | 2020-04-23 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects JR6150 before 1.0.1.10, PR2000 before 1.0.0.18, R6050 be… |
CVE-2017-18734 | High | 8.8 | 2020-04-23 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects JNR1010v2 before 1.1.0.44, JR6150 before 1.0.1.10, JWNR2… |
CVE-2020-7489 | Critical | 9.8 | 2020-04-22 | A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability exists on EcoStruxure Machine Expert… |
CVE-2017-18754 | Medium | 6.8 | 2020-04-22 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WNDR3700v4 before 1.0.2.88, WNDR4300v1 before 1.0.2.90, and WN… |
CVE-2018-21123 | High | 8.8 | 2020-04-22 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects WC7500 before 6.5.3.9, WC7520 before 6.5.3.9, WC7600v1 b… |
CVE-2018-21119 | Medium | 6.8 | 2020-04-22 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WAC505 before 5.0.5.4 and WAC510 before 5.0.5.4. |
CVE-2017-18767 | Medium | 6.8 | 2020-04-22 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.34, D8500 before 1.0.3.39, R6400 before 1.0… |
CVE-2017-18764 | High | 8.8 | 2020-04-22 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D6100 before 1.0.0.55, D7000 before 1.0.1.50, D7800 befo… |
CVE-2017-18762 | High | 8.8 | 2020-04-22 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D3600 before 1.0.0.68, D6000 before 1.0.0.68, D6100 befo… |
CVE-2018-21114 | Medium | 6.8 | 2020-04-22 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.44, EX6150v2 before 1.0.1.70, EX6100v2 befo… |
CVE-2018-21113 | High | 8.8 | 2020-04-22 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D6100 before 1.0.0.58, D7800 before 1.0.1.42, R6100 befo… |
CVE-2018-21112 | Medium | 6.8 | 2020-04-22 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.44, R7500v2 before 1.0.3.38, R7800 before 1… |
CVE-2017-18787 | High | 7.8 | 2020-04-22 | Certain NETGEAR devices are affected by command injection. This affects D6200 before 1.1.00.24, JNR1010v2 before 1.1.0.44, JR6150 before 1.0.1.12, JWNR2010v5 b… |
CVE-2017-18786 | High | 7.8 | 2020-04-22 | Certain NETGEAR devices are affected by command injection. This affects D6200 before 1.1.00.24, JNR1010v2 before 1.1.0.44, JR6150 before 1.0.1.12, JWNR2010v5 b… |
CVE-2017-18773 | Medium | 6.7 | 2020-04-22 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6100 before V1.0.0.55, D7800 before V1.0.1.24, EX6150v2 befor… |
CVE-2017-18788 | Medium | 6.7 | 2020-04-22 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.67, D6000 before 1.0.0.67, D6100 before 1.0… |
CVE-2018-21146 | Medium | 6.8 | 2020-04-21 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.34, R7800 before 1.0.2.42, R8900 before 1.0… |
CVE-2017-18801 | Medium | 6.7 | 2020-04-21 | Certain NETGEAR devices are affected by command injection. This affects R6220 before 1.1.0.50, R6700v2 before 1.1.0.38, R6800 before 1.1.0.38, WNDR3700v5 befor… |
CVE-2017-18796 | Medium | 6.7 | 2020-04-21 | Certain NETGEAR devices are affected by command injection. This affects R6400 before 1.0.1.24, R6700 before 1.0.1.26, R6900 before 1.0.1.28, R7000 before 1.0.9… |
CVE-2017-18795 | Medium | 6.7 | 2020-04-21 | Certain NETGEAR devices are affected by command injection. This affects D6220 before 1.0.0.28 and D6100 before 1.0.0.50_0.0.50. |
CVE-2017-18794 | High | 8.4 | 2020-04-21 | Certain NETGEAR devices are affected by command injection. This affects R6300v2 before 1.0.4.8_10.0.77, R6400 before 1.0.1.24, R6700 before 1.0.1.26, R7000 bef… |
CVE-2017-18793 | Medium | 6.7 | 2020-04-21 | NETGEAR R7800 devices before 1.0.2.36 are affected by command injection. |
CVE-2017-18792 | High | 8.4 | 2020-04-21 | NETGEAR D6100 devices before 1.0.0.50_0.0.50 are affected by command injection. |
CVE-2017-18805 | Medium | 6.7 | 2020-04-21 | Certain NETGEAR devices are affected by command injection. This affects WAC510 before 1.3.0.10, WAC120 before 2.1.4, WNDAP620 before 2.1.3, WND930 before 2.1.2… |
CVE-2017-18804 | Medium | 6.7 | 2020-04-21 | Certain NETGEAR devices are affected by command injection. This affects R7800 before 1.0.2.16 and R9000 before 1.0.2.4. |
CVE-2017-18802 | Medium | 6.7 | 2020-04-21 | Certain NETGEAR devices are affected by command injection. This affects R6100 before 1.0.1.14, R7500 before 1.0.0.110, R7500v2 before 1.0.3.16, R7800 before 1… |
CVE-2017-18806 | Medium | 6.7 | 2020-04-21 | Certain NETGEAR devices are affected by command injection. This affects WAC510 before 1.3.0.10, WAC120 before 2.1.4, WNDAP620 before 2.1.3, WND930 before 2.1.2… |
CVE-2017-18849 | High | 7.8 | 2020-04-20 | Certain NETGEAR devices are affected by command injection. This affects D6220 before 1.0.0.26, D6400 before 1.0.0.60, D8500 before 1.0.3.29, R6250 before 1.0.4… |
CVE-2017-18841 | Medium | 6.7 | 2020-04-20 | Certain NETGEAR devices are affected by command injection. This affects R6220 before 1.1.0.46, R6700v2 before 1.1.0.38, R6800 before 1.1.0.38, WNDR3700v5 befor… |
CVE-2017-18851 | Medium | 6.7 | 2020-04-20 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D8500 through 1.0.3.28, R6400 through 1.0.1.22, R6400v2 throug… |
CVE-2020-7111 | High | 7.2 | 2020-04-16 | A server side injection vulnerability exists which could allow an authenticated administrative user to achieve Remote Code Execution in ClearPass. Resolution… |
CVE-2020-11814 | Medium | 5.4 | 2020-04-16 | A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites. |
CVE-2020-11709 | High | 7.5 | 2020-04-12 | cpp-httplib through 0.5.8 does not filter \r\n in parameters passed into the set_redirect and set_header functions, which creates possibilities for CRLF inject… |
CVE-2020-11703 | High | 7.5 | 2020-04-12 | An issue was discovered in ProVide (formerly zFTPServer) through 13.1. /ajax/GetInheritedProperties allows HTTP Response Splitting via the language parameter. |
CVE-2020-11002 | High | 8.0 | 2020-04-10 | dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-v… |
CVE-2018-21051 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) (Exynos chipsets) software. There is an invalid free in the fingerprint Trustlet, lead… |
CVE-2017-18652 | Critical | 9.8 | 2020-04-07 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. SVoice allows arbitrary code execution by changing dynamic libraries. The Sa… |
CVE-2020-11593 | High | 7.5 | 2020-04-06 | An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request with injected HTML data that is la… |
CVE-2020-10960 | Medium | 5.3 | 2020-04-03 | In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface)… |
CVE-2020-1958 | Medium | 6.5 | 2020-04-01 | When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.user… |
CVE-2020-3884 | Medium | 6.1 | 2020-04-01 | An injection issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A remote attacker may be able to cause arbitrary java… |
CVE-2020-11441 | Medium | 6.1 | 2020-03-31 | phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error pa… |
CVE-2020-6982 | High | 8.8 | 2020-03-24 | In Honeywell WIN-PAK 4.7.2, Web and prior versions, the header injection vulnerability has been identified, which may allow remote code execution. |
CVE-2020-7475 | Critical | 9.8 | 2020-03-23 | A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), reflective DLL, vulnerability exists in EcoStruxu… |
CVE-2013-7487 | Critical | 9.8 | 2020-03-21 | On Swann DVR04B, DVR08B, DVR-16CIF, and DVR16B devices, raysharpdvr application has a vulnerable call to “system”, which allows remote attackers to execute arb… |
CVE-2019-18860 | Medium | 6.1 | 2020-03-20 | Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi. |
CVE-2019-12416 | Medium | 6.1 | 2020-03-19 | we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWindowStrategy which… |
CVE-2020-8468 | High | 8.8 | 2020-03-18 | Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability w… |
CVE-2019-11073 | High | 7.2 | 2020-03-16 | A Remote Code Execution vulnerability exists in PRTG Network Monitor before 19.4.54.1506 that allows attackers to execute code due to insufficient sanitization… |
CVE-2020-6858 | Medium | 6.5 | 2020-03-12 | Hotels Styx through 1.0.0.beta8 allows HTTP response splitting due to CRLF Injection. This is exploitable if untrusted user input can appear in a response head… |
CVE-2020-5259 | High | 7.7 | 2020-03-10 | In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject propert… |
CVE-2019-19614 | High | 7.5 | 2020-03-09 | An issue was discovered in Halvotec RAQuest 10.23.10801.0. The login page is vulnerable to wildcard injection, allowing an attacker to enumerate the list of us… |
CVE-2020-9757 | Critical | 9.8 | 2020-03-04 | The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller. |
CVE-2020-5249 | Medium | 6.5 | 2020-03-02 | In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return… |
CVE-2020-5247 | Medium | 6.5 | 2020-02-28 | In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline charact… |
CVE-2020-9382 | Medium | 5.4 | 2020-02-24 | An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title sanitization allowed for the execution of any wiki page as a widge… |