CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) (page 50)
Page 50 of 51 — CVEs classified under CWE-74, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-10845 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/check_system_storable (SEC-78). |
CVE-2018-20914 | High | 7.3 | 2019-08-01 | In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files (SEC-368). |
CVE-2018-20898 | Medium | 4.3 | 2019-08-01 | cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396). |
CVE-2018-20885 | Medium | 5.3 | 2019-08-01 | cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation (SEC-416). |
CVE-2019-1020006 | Medium | 6.1 | 2019-07-29 | invenio-app before 1.1.1 allows host header injection. |
CVE-2019-9811 | High | 8.3 | 2019-07-23 | As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that… |
CVE-2019-11718 | Medium | 5.3 | 2019-07-23 | Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without saniti… |
CVE-2019-13915 | High | 7.5 | 2019-07-18 | b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files. First, the attacker can write code in the editor, and compile and run it appro… |
CVE-2019-1010310 | Low | 3.5 | 2019-07-12 | GLPI GLPI Product 9.3.1 is affected by: Frame and Form tags Injection allowing admins to phish users by putting code in reminder description. The impact is: Ad… |
CVE-2019-0319 | High | 7.5 | 2019-07-10 | The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could… |
CVE-2019-13146 | Medium | 5.3 | 2019-07-09 | The field_test gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return an… |
CVE-2016-10761 | Medium | 6.5 | 2019-06-29 | Logitech Unifying devices before 2016-02-26 allow keystroke injection, bypassing encryption, aka MouseJack. |
CVE-2019-12966 | Critical | 9.8 | 2019-06-26 | FeHelper through 2019-06-19 allows arbitrary code execution during a JSON format operation, as demonstrated by the {"a":(function(){confirm(1)})()} input. |
CVE-2019-8323 | High | 7.5 | 2019-06-17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefor… |
CVE-2019-8322 | High | 7.5 | 2019-06-17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore… |
CVE-2019-8325 | High | 7.5 | 2019-06-17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is… |
CVE-2019-0304 | Critical | 9.8 | 2019-06-12 | FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EX… |
CVE-2019-12387 | Medium | 6.1 | 2019-06-10 | In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF. |
CVE-2019-12303 | High | 8.8 | 2019-06-06 | In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container. |
CVE-2019-6800 | High | 7.5 | 2019-06-05 | In TitanHQ SpamTitan through 7.03, a vulnerability exists in the spam rule update function. Updates are downloaded over HTTP, including scripts which are subse… |
CVE-2016-8900 | Critical | 9.8 | 2019-05-24 | Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expTagController.php related to change_tags. |
CVE-2016-8899 | Critical | 9.8 | 2019-05-23 | Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expCatController.php related to change_cats. |
CVE-2016-8901 | Critical | 9.8 | 2019-05-23 | b2evolution 6.7.6 suffer from an Object Injection vulnerability in /htsrv/call_plugin.php. |
CVE-2019-3562 | Medium | 6.1 | 2019-04-29 | A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the… |
CVE-2019-2725 | Critical | 9.8 | 2019-04-26 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6… |
CVE-2019-9900 | High | 8.3 | 2019-04-25 | When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting he… |
CVE-2019-11354 | High | 7.8 | 2019-04-19 | The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to e… |
CVE-2018-1943 | Medium | 5.4 | 2019-04-08 | IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specia… |
CVE-2015-5462 | Medium | 6.1 | 2019-04-03 | AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier allows remote attackers to inject HTML into the scoping dashboard features. |
CVE-2018-4153 | Medium | 5.9 | 2019-04-03 | An injection issue was addressed with improved validation. This issue affected versions prior to macOS Mojave 10.14. |
CVE-2019-9614 | High | 8.8 | 2019-03-06 | An issue was discovered in OFCMS before 1.1.3. A command execution vulnerability exists via a template file with '<#assign ex="freemarker.template.utility.Exec… |
CVE-2019-8948 | Critical | 9.8 | 2019-02-20 | PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163. |
CVE-2019-1680 | Medium | 4.3 | 2019-02-07 | A vulnerability in Cisco Webex Business Suite could allow an unauthenticated, remote attacker to inject arbitrary text into a user's browser. The vulnerability… |
CVE-2018-18996 | Critical | 9.8 | 2019-02-05 | LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an attacker to execute re… |
CVE-2018-18992 | High | 8.8 | 2019-02-05 | LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper sanitation, which may allow an attacker to execute remote code on the… |
CVE-2017-1202 | Medium | 5.4 | 2019-02-05 | IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when v… |
CVE-2019-7351 | Medium | 6.5 | 2019-02-04 | Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom L… |
CVE-2018-16492 | Critical | 9.8 | 2019-02-01 | A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype. |
CVE-2018-16491 | Critical | 9.8 | 2019-02-01 | A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype. |
CVE-2018-16490 | High | 7.5 | 2019-02-01 | A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype. |
CVE-2018-16489 | Critical | 9.8 | 2019-02-01 | A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions. |
CVE-2018-16486 | Critical | 9.8 | 2019-02-01 | A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype. |
CVE-2019-6802 | Medium | 6.1 | 2019-01-25 | CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI. |
CVE-2019-3498 | Medium | 6.5 | 2019-01-09 | In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Com… |
CVE-2018-16627 | Medium | 6.1 | 2018-12-20 | panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature. |
CVE-2018-1000854 | Critical | 9.8 | 2018-12-20 | esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection… |
CVE-2018-18250 | High | 7.5 | 2018-12-17 | Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navigation item. |
CVE-2018-20167 | High | 7.8 | 2018-12-17 | Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe "cat README.md" command when \e}pn is used… |
CVE-2018-1474 | Medium | 6.1 | 2018-12-12 | IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied… |
CVE-2018-1896 | Medium | 4.6 | 2018-12-07 | IBM Connections 5.0, 5.5, and 6.0 is vulnerable to possible host header injection attack that could cause navigation to the attacker's domain. IBM X-Force ID… |
CVE-2018-18207 | Medium | 6.1 | 2018-10-10 | Virtualmin 6.03 allows Frame Injection via the settings-editor_read.cgi file parameter. |
CVE-2018-16763 | Critical | 9.8 | 2018-09-09 | FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Executio… |
CVE-2017-1115 | Medium | 5.4 | 2018-09-07 | IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in th… |
CVE-2018-9062 | Medium | 6.8 | 2018-07-19 | In some Lenovo ThinkPad products, one BIOS region is not properly included in the checks, allowing injection of arbitrary code. |
CVE-2018-1549 | Medium | 5.4 | 2018-07-10 | IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vu… |
CVE-2018-4995 | Critical | 9.8 | 2018-07-09 | Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an XFA '\n' POST injection vulner… |
CVE-2018-0313 | High | 8.8 | 2018-06-21 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to send a malicious packet to the management interf… |
CVE-2017-7848 | Medium | 5.3 | 2018-06-11 | RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird < 52.5.2. |
CVE-2017-7846 | High | 8.8 | 2018-06-11 | It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View -> Feed article -> Website" or in the standard… |
CVE-2017-7788 | Critical | 9.8 | 2018-06-11 | When an "iframe" has a "sandbox" attribute and its content is specified using "srcdoc", that content does not inherit the containing page's Content Security Po… |
CVE-2018-4235 | Medium | 5.5 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before… |
CVE-2018-1000193 | Medium | 4.3 | 2018-06-05 | A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that a… |
CVE-2017-16043 | Medium | 6.1 | 2018-06-04 | Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's… |
CVE-2017-6015 | High | 7.8 | 2018-05-11 | Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02 remains ambiguous, which may allow an a… |
CVE-2017-18266 | High | 8.8 | 2018-05-10 | The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment vari… |
CVE-2016-10498 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9635M, MDM9645, MDM9650, MDM9655, SD 210/SD 212/SD 205, SD 400, S… |
CVE-2014-2294 | Critical | 9.8 | 2018-04-17 | Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted serialized object in the owa_event paramete… |
CVE-2017-0372 | Critical | 9.8 | 2018-04-13 | Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities. |
CVE-2017-4028 | Medium | 5.0 | 2018-04-03 | Maliciously misconfigured registry vulnerability in all Microsoft Windows products in McAfee consumer and corporate products allows an administrator to inject… |
CVE-2015-1975 | High | 7.8 | 2018-04-03 | The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, and 6.3 before iFix 37 and IBM… |
CVE-2018-4106 | High | 8.8 | 2018-04-03 | An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the Bracketed Paste Mode of the "Terminal" component. I… |
CVE-2018-1319 | Medium | 6.1 | 2018-03-15 | In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting. If a victim goes to a maliciously crafted URL, unwanted results m… |
CVE-2018-6220 | Critical | 9.8 | 2018-03-15 | An arbitrary file write vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject arbitrary data, which may lead to gaining c… |
CVE-2018-1000130 | High | 8.1 | 2018-03-14 | A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server. |
CVE-2015-5377 | Critical | 9.8 | 2018-03-06 | Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to cl… |
CVE-2017-10963 | Medium | 5.9 | 2018-02-20 | In Knox SDS IAM (Identity Access Management) and EMM (Enterprise Mobility Management) 16.11 on Samsung mobile devices, a man-in-the-middle attacker can install… |
CVE-2017-5799 | High | 8.8 | 2018-02-15 | A Remote Code Execution vulnerability in HPE OpenCall Media Platform (OCMP) was found. The vulnerability impacts OCMP versions prior to 3.4.2 RP201 (for OCMP 3… |
CVE-2018-7032 | High | 7.5 | 2018-02-14 | webcheckout in myrepos through 1.20171231 does not sanitize URLs that are passed to git clone, allowing a malicious website operator or a MitM attacker to take… |
CVE-2018-6603 | Medium | 6.1 | 2018-02-07 | Promise Technology WebPam Pro-E devices allow remote attackers to conduct XSS, HTTP Response Splitting, and CRLF Injection attacks via JavaScript code in a PHP… |
CVE-2018-6289 | Critical | 9.8 | 2018-02-06 | Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1. |
CVE-2018-6519 | High | 7.5 | 2018-02-02 | The SAML2 library before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1 in SimpleSAMLphp has a Regular Expression Denial of Service vulnerability for fraction-… |
CVE-2017-14523 | High | 7.5 | 2018-01-26 | WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitatio… |
CVE-2017-18049 | Medium | 5.5 | 2018-01-23 | In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it's possible for the output to contain macros and scripts, w… |
CVE-2017-14094 | Critical | 9.8 | 2018-01-19 | A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a cr… |
CVE-2014-7952 | High | 7.8 | 2018-01-12 | The backup mechanism in the adb tool in Android might allow attackers to inject additional applications (APKs) and execute arbitrary code by leveraging failure… |
CVE-2017-15714 | Critical | 9.8 | 2018-01-04 | The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through th… |
CVE-2017-1000493 | Critical | 9.8 | 2018-01-03 | Rocket.Chat Server version 0.59 and prior is vulnerable to a NoSQL injection leading to administrator account takeover |
CVE-2017-1000454 | High | 7.8 | 2018-01-02 | CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file… |
CVE-2017-1000453 | Critical | 9.8 | 2018-01-02 | CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution. |
CVE-2013-4578 | Medium | 5.3 | 2017-12-29 | jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a s… |
CVE-2016-3695 | Medium | 5.5 | 2017-12-29 | The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to simulate hardware errors and consequently cause a denial o… |
CVE-2017-15313 | High | 8.8 | 2017-12-22 | Huawei SmartCare V200R003C10 has a CSV injection vulnerability. An remote authenticated attacker could inject malicious CSV expression to the affected device. |
CVE-2017-16766 | Medium | 6.5 | 2017-12-22 | An improper access control vulnerability in synodsmnotify in Synology DiskStation Manager (DSM) before 6.1.4-15217 and before 6.0.3-8754-6 allows local users t… |
CVE-2017-17790 | Critical | 9.8 | 2017-12-20 | The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv… |
CVE-2017-17535 | High | 8.8 | 2017-12-14 | lib/gui.py in Bob Hepple gjots2 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow r… |
CVE-2017-17534 | High | 8.8 | 2017-12-14 | uiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote at… |
CVE-2017-17533 | High | 8.8 | 2017-12-14 | default.tcl in Tkabber 1.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attac… |
CVE-2017-17532 | High | 8.8 | 2017-12-14 | examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which mig… |
CVE-2017-17531 | High | 8.8 | 2017-12-14 | gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote at… |
CVE-2017-17530 | High | 8.8 | 2017-12-14 | common/help.c in Geomview 1.9.5 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote… |