CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) (page 54)
Page 54 of 55 — CVEs classified under CWE-74, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-3562 | Medium | 6.1 | 2019-04-29 | A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the… |
CVE-2019-2725 | Critical | 9.8 | 2019-04-26 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6… |
CVE-2019-9900 | High | 8.3 | 2019-04-25 | When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting he… |
CVE-2019-11354 | High | 7.8 | 2019-04-19 | The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to e… |
CVE-2018-1943 | Medium | 5.4 | 2019-04-08 | IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specia… |
CVE-2015-5462 | Medium | 6.1 | 2019-04-03 | AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier allows remote attackers to inject HTML into the scoping dashboard features. |
CVE-2018-4153 | Medium | 5.9 | 2019-04-03 | An injection issue was addressed with improved validation. This issue affected versions prior to macOS Mojave 10.14. |
CVE-2019-9614 | High | 8.8 | 2019-03-06 | An issue was discovered in OFCMS before 1.1.3. A command execution vulnerability exists via a template file with '<#assign ex="freemarker.template.utility.Exec… |
CVE-2019-8948 | Critical | 9.8 | 2019-02-20 | PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163. |
CVE-2019-1680 | Medium | 4.3 | 2019-02-07 | A vulnerability in Cisco Webex Business Suite could allow an unauthenticated, remote attacker to inject arbitrary text into a user's browser. The vulnerability… |
CVE-2018-18996 | Critical | 9.8 | 2019-02-05 | LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an attacker to execute re… |
CVE-2018-18992 | High | 8.8 | 2019-02-05 | LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper sanitation, which may allow an attacker to execute remote code on the… |
CVE-2017-1202 | Medium | 5.4 | 2019-02-05 | IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when v… |
CVE-2019-7351 | Medium | 6.5 | 2019-02-04 | Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom L… |
CVE-2018-16492 | Critical | 9.8 | 2019-02-01 | A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype. |
CVE-2018-16491 | Critical | 9.8 | 2019-02-01 | A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype. |
CVE-2018-16490 | High | 7.5 | 2019-02-01 | A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype. |
CVE-2018-16489 | Critical | 9.8 | 2019-02-01 | A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions. |
CVE-2018-16486 | Critical | 9.8 | 2019-02-01 | A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype. |
CVE-2019-6802 | Medium | 6.1 | 2019-01-25 | CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI. |
CVE-2019-3498 | Medium | 6.5 | 2019-01-09 | In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Com… |
CVE-2018-16627 | Medium | 6.1 | 2018-12-20 | panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature. |
CVE-2018-1000854 | Critical | 9.8 | 2018-12-20 | esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection… |
CVE-2018-18250 | High | 7.5 | 2018-12-17 | Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navigation item. |
CVE-2018-20167 | High | 7.8 | 2018-12-17 | Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe "cat README.md" command when \e}pn is used… |
CVE-2018-1474 | Medium | 6.1 | 2018-12-12 | IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied… |
CVE-2018-1896 | Medium | 4.6 | 2018-12-07 | IBM Connections 5.0, 5.5, and 6.0 is vulnerable to possible host header injection attack that could cause navigation to the attacker's domain. IBM X-Force ID… |
CVE-2018-18207 | Medium | 6.1 | 2018-10-10 | Virtualmin 6.03 allows Frame Injection via the settings-editor_read.cgi file parameter. |
CVE-2018-16763 | Critical | 9.8 | 2018-09-09 | FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Executio… |
CVE-2017-1115 | Medium | 5.4 | 2018-09-07 | IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in th… |
CVE-2018-9062 | Medium | 6.8 | 2018-07-19 | In some Lenovo ThinkPad products, one BIOS region is not properly included in the checks, allowing injection of arbitrary code. |
CVE-2018-1549 | Medium | 5.4 | 2018-07-10 | IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vu… |
CVE-2018-4995 | Critical | 9.8 | 2018-07-09 | Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an XFA '\n' POST injection vulner… |
CVE-2018-0313 | High | 8.8 | 2018-06-21 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to send a malicious packet to the management interf… |
CVE-2017-7848 | Medium | 5.3 | 2018-06-11 | RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird < 52.5.2. |
CVE-2017-7846 | High | 8.8 | 2018-06-11 | It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View -> Feed article -> Website" or in the standard… |
CVE-2017-7788 | Critical | 9.8 | 2018-06-11 | When an "iframe" has a "sandbox" attribute and its content is specified using "srcdoc", that content does not inherit the containing page's Content Security Po… |
CVE-2018-4235 | Medium | 5.5 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before… |
CVE-2018-1000193 | Medium | 4.3 | 2018-06-05 | A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that a… |
CVE-2017-16043 | Medium | 6.1 | 2018-06-04 | Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's… |
CVE-2017-6015 | High | 7.8 | 2018-05-11 | Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02 remains ambiguous, which may allow an a… |
CVE-2017-18266 | High | 8.8 | 2018-05-10 | The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment vari… |
CVE-2016-10498 | Critical | 9.8 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9635M, MDM9645, MDM9650, MDM9655, SD 210/SD 212/SD 205, SD 400, S… |
CVE-2014-2294 | Critical | 9.8 | 2018-04-17 | Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted serialized object in the owa_event paramete… |
CVE-2017-0372 | Critical | 9.8 | 2018-04-13 | Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities. |
CVE-2017-4028 | Medium | 5.0 | 2018-04-03 | Maliciously misconfigured registry vulnerability in all Microsoft Windows products in McAfee consumer and corporate products allows an administrator to inject… |
CVE-2015-1975 | High | 7.8 | 2018-04-03 | The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, and 6.3 before iFix 37 and IBM… |
CVE-2018-4106 | High | 8.8 | 2018-04-03 | An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the Bracketed Paste Mode of the "Terminal" component. I… |
CVE-2018-1319 | Medium | 6.1 | 2018-03-15 | In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting. If a victim goes to a maliciously crafted URL, unwanted results m… |
CVE-2018-6220 | Critical | 9.8 | 2018-03-15 | An arbitrary file write vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject arbitrary data, which may lead to gaining c… |
CVE-2018-1000130 | High | 8.1 | 2018-03-14 | A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server. |
CVE-2015-5377 | Critical | 9.8 | 2018-03-06 | Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to cl… |
CVE-2017-10963 | Medium | 5.9 | 2018-02-20 | In Knox SDS IAM (Identity Access Management) and EMM (Enterprise Mobility Management) 16.11 on Samsung mobile devices, a man-in-the-middle attacker can install… |
CVE-2017-5799 | High | 8.8 | 2018-02-15 | A Remote Code Execution vulnerability in HPE OpenCall Media Platform (OCMP) was found. The vulnerability impacts OCMP versions prior to 3.4.2 RP201 (for OCMP 3… |
CVE-2018-7032 | High | 7.5 | 2018-02-14 | webcheckout in myrepos through 1.20171231 does not sanitize URLs that are passed to git clone, allowing a malicious website operator or a MitM attacker to take… |
CVE-2018-6603 | Medium | 6.1 | 2018-02-07 | Promise Technology WebPam Pro-E devices allow remote attackers to conduct XSS, HTTP Response Splitting, and CRLF Injection attacks via JavaScript code in a PHP… |
CVE-2018-6289 | Critical | 9.8 | 2018-02-06 | Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1. |
CVE-2018-6519 | High | 7.5 | 2018-02-02 | The SAML2 library before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1 in SimpleSAMLphp has a Regular Expression Denial of Service vulnerability for fraction-… |
CVE-2017-14523 | High | 7.5 | 2018-01-26 | WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitatio… |
CVE-2017-18049 | Medium | 5.5 | 2018-01-23 | In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it's possible for the output to contain macros and scripts, w… |
CVE-2017-14094 | Critical | 9.8 | 2018-01-19 | A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a cr… |
CVE-2014-7952 | High | 7.8 | 2018-01-12 | The backup mechanism in the adb tool in Android might allow attackers to inject additional applications (APKs) and execute arbitrary code by leveraging failure… |
CVE-2017-15714 | Critical | 9.8 | 2018-01-04 | The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through th… |
CVE-2017-1000493 | Critical | 9.8 | 2018-01-03 | Rocket.Chat Server version 0.59 and prior is vulnerable to a NoSQL injection leading to administrator account takeover |
CVE-2017-1000454 | High | 7.8 | 2018-01-02 | CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file… |
CVE-2017-1000453 | Critical | 9.8 | 2018-01-02 | CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution. |
CVE-2013-4578 | Medium | 5.3 | 2017-12-29 | jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a s… |
CVE-2016-3695 | Medium | 5.5 | 2017-12-29 | The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to simulate hardware errors and consequently cause a denial o… |
CVE-2017-15313 | High | 8.8 | 2017-12-22 | Huawei SmartCare V200R003C10 has a CSV injection vulnerability. An remote authenticated attacker could inject malicious CSV expression to the affected device. |
CVE-2017-16766 | Medium | 6.5 | 2017-12-22 | An improper access control vulnerability in synodsmnotify in Synology DiskStation Manager (DSM) before 6.1.4-15217 and before 6.0.3-8754-6 allows local users t… |
CVE-2017-17790 | Critical | 9.8 | 2017-12-20 | The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv… |
CVE-2017-17535 | High | 8.8 | 2017-12-14 | lib/gui.py in Bob Hepple gjots2 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow r… |
CVE-2017-17534 | High | 8.8 | 2017-12-14 | uiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote at… |
CVE-2017-17533 | High | 8.8 | 2017-12-14 | default.tcl in Tkabber 1.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attac… |
CVE-2017-17532 | High | 8.8 | 2017-12-14 | examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which mig… |
CVE-2017-17531 | High | 8.8 | 2017-12-14 | gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote at… |
CVE-2017-17530 | High | 8.8 | 2017-12-14 | common/help.c in Geomview 1.9.5 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote… |
CVE-2017-17529 | High | 8.8 | 2017-12-14 | af/util/xp/ut_go_file.cpp in AbiWord 3.0.2-2 does not validate strings before launching the program specified by the BROWSER environment variable, which might… |
CVE-2017-17528 | High | 8.8 | 2017-12-14 | backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, wh… |
CVE-2017-17527 | High | 8.8 | 2017-12-14 | delphi_gui/WWWBrowserRunnerDM.pas in PasDoc 0.14 does not validate strings before launching the program specified by the BROWSER environment variable, which mi… |
CVE-2017-17526 | High | 8.8 | 2017-12-14 | Input.cc in Bernard Parisse Giac 1.2.3.57 does not validate strings before launching the program specified by the BROWSER environment variable, which might all… |
CVE-2017-17525 | High | 8.8 | 2017-12-14 | guiclient/guiclient.cpp in xTuple PostBooks 4.7.0 does not validate strings before launching the program specified by the BROWSER environment variable, which m… |
CVE-2017-17524 | High | 8.8 | 2017-12-14 | library/www_browser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might al… |
CVE-2017-17522 | High | 8.8 | 2017-12-14 | Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might all… |
CVE-2017-17521 | High | 8.8 | 2017-12-14 | uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow… |
CVE-2017-17520 | High | 8.8 | 2017-12-14 | tools/url_handler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remot… |
CVE-2017-17519 | High | 8.8 | 2017-12-14 | batteriesConfig.mlp in OCaml Batteries Included (aka ocaml-batteries) 2.6 does not validate strings before launching the program specified by the BROWSER envir… |
CVE-2017-17518 | High | 8.8 | 2017-12-14 | swt/motif/browser.c in White_dune (aka whitedune) 0.30.10 does not validate strings before launching the program specified by the BROWSER environment variable… |
CVE-2017-17517 | High | 8.8 | 2017-12-14 | libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allo… |
CVE-2017-17516 | High | 8.8 | 2017-12-14 | scripts/inspect_webbrowser.py in Reddit Terminal Viewer (RTV) 1.19.0 does not validate strings before launching the program specified by the BROWSER environmen… |
CVE-2017-17515 | High | 8.8 | 2017-12-14 | etc/ObjectList in Metview 4.7.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote… |
CVE-2017-17514 | High | 8.8 | 2017-12-14 | boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers… |
CVE-2017-17513 | High | 8.8 | 2017-12-14 | TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attack… |
CVE-2017-17511 | High | 8.8 | 2017-12-14 | KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to co… |
CVE-2017-16680 | High | 7.5 | 2017-12-12 | Two potential audit log injections in SAP HANA extended application services 1.0, advanced model: 1) Certain HTTP/REST endpoints of controller service are miss… |
CVE-2017-15708 | Critical | 9.8 | 2017-12-11 | In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2… |
CVE-2017-17523 | High | 8.8 | 2017-12-11 | lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows r… |
CVE-2017-17512 | High | 8.8 | 2017-12-11 | sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which al… |
CVE-2017-1000217 | High | 8.8 | 2017-11-17 | Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code exe… |
CVE-2017-16719 | High | 7.5 | 2017-11-16 | An Injection issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 Version 3… |