CWE-74

ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacke

vscode-stripe is an extension for Visual Studio Code. A vulnerability in Stripe for Visual Studio Code extension exists

The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulner

There is a JavaScript injection vulnerability in certain Huawei smartphones. A module does not verify some inputs suffic

Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements.

An issue was discovered in SolarWinds Serv-U before 15.2.2. Unauthenticated attackers can retrieve cleartext passwords v

Due to improper input sanitization, specially crafted LDAP queries can be injected by an unauthenticated user. This coul

Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1.4 and 11.5.5 is vulnerable to a denial of service as

Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Secu

An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x befor

The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injectio

The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending.

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, r

There is an Injection attack vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect

JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service.

SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the command line arguments to pass in any value to the

CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. I

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovere

A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbit

WarnSystem is a cog (plugin) for the Red discord bot. A vulnerability has been found in the code that allows any user to

In onBindViewHolder of AppSwitchPreference.java, there is a possible bypass of device admin setttings due to unclear UI.

Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers,

Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding ex

An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows remote attackers to exec

A Server Side Template Injection in the Entando Admin Console 6.3.9 and before allows a user with privileges to execute

Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary

Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since v

SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One on SAP

Certain NETGEAR devices are affected by server-side injection. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.7

Certain NETGEAR devices are affected by server-side injection. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.7

Certain NETGEAR devices are affected by server-side injection. This affects D7800 before 1.0.1.58, DM200 before 1.0.0.66

Certain NETGEAR devices are affected by server-side injection. This affects RBK40 before 2.5.1.16, RBR40 before 2.5.1.16

Certain NETGEAR devices are affected by server-side injection. This affects RBK40 before 2.5.1.16, RBR40 before 2.5.1.16

Certain NETGEAR devices are affected by server-side injection. This affects RBK40 before 2.5.1.16, RBR40 before 2.5.1.16

STMicroelectronics STM32L4 devices through 2020-10-19 have incorrect access control. The flash read-out protection (RDP)

radsecproxy is a generic RADIUS proxy that supports both UDP and TLS (RadSec) RADIUS transports. Missing input validatio

NETGEAR R6400 devices before 1.0.1.70 are affected by server-side injection.

Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerabil

Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker wa

GLPI is a free Asset and IT management software package. Starting in version 9.1 and prior to version 9.5.6, GLPI with A

With an admin account, the .htaccess file in Artica Pandora FMS <=755 can be overwritten with the File Manager component

Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected v

Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. This is a fol

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a r

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 is vulnerable to HTTP header injection, caused by improper validation of

Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to obtain pote

Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to b

app/views_mod/user/user.py in LibrIT PaSSHport through 2.5 is affected by LDAP Injection. There is an information leak t