CWE-74

The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code in

A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to pe

Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1.

Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the trans

An arbitrary file write vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject arbi

Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in mul

Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted seri

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9635M, MDM9645, MDM9650, M

When an "iframe" has a "sandbox" attribute and its content is specified using "srcdoc", that content does not inherit th

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Use

A Remote Code Execution vulnerability in HPE OpenCall Media Platform (OCMP) was found. The vulnerability impacts OCMP ve

An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the Bracketed Pa

The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program sp

It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View -> Feed

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to send a ma

A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to

CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in loca

The backup mechanism in the adb tool in Android might allow attackers to inject additional applications (APKs) and execu

The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before i

Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02

Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe "cat

WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NO

The SAML2 library before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1 in SimpleSAMLphp has a Regular Expression Denial

webcheckout in myrepos through 1.20171231 does not sanitize URLs that are passed to git clone, allowing a malicious webs

Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as

In some Lenovo ThinkPad products, one BIOS region is not properly included in the checks, allowing injection of arbitrar

Promise Technology WebPam Pro-E devices allow remote attackers to conduct XSS, HTTP Response Splitting, and CRLF Injecti

In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting. If a victim goes to a mali

Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML

Virtualmin 6.03 allows Frame Injection via the settings-editor_read.cgi file parameter.

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 is vulnerable to HTTP response splitting attacks, caused

panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature.

In Knox SDS IAM (Identity Access Management) and EMM (Enterprise Mobility Management) 16.11 on Samsung mobile devices, a

In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it's possible for the

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b

IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to HTTP response splitting attacks.

IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, whi

RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects

Maliciously misconfigured registry vulnerability in all Microsoft Windows products in McAfee consumer and corporate prod

IBM Connections 5.0, 5.5, and 6.0 is vulnerable to possible host header injection attack that could cause navigation to

A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in

system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging c

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary

The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking a

Ninka before 1.3.2 might allow remote attackers to obtain sensitive information, manipulate license compliance scan resu

HTTP header injection vulnerability in the URLConnection class in Android OS 2.2 through 6.0 allows remote attackers to

An issue was discovered in SMA Solar Technology products. The SIP implementation does not properly use authentication wi

AnyDesk before 3.6.1 on Windows has a DLL injection vulnerability.