CWE-74

dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying

All versions of component-flatten are vulnerable to Prototype Pollution. The a function could be tricked into adding or

undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying

CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x befo

we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selec

Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.c

phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF s

An injection issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A remote attac

Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer reque

Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially craft

The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute).

JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection.

RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could

Multiple vulnerabilities in the web UI of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote

An issue was discovered in the http package through 0.12.2 for Dart. If the attacker controls the HTTP method and the ap

Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When

evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server send

An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The S

An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title sanitization allowed for th

A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injectio

Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache template

A vulnerability in the AntivirusforMac binary as used in Bitdefender Antivirus for Mac allows an attacker to inject a li

statusnet through 2010 allows attackers to spoof syslog messages via newline injection attacks.

Webkit-GTK 2.x (any version with HTML5 audio/video support based on GStreamer) allows remote attackers to trigger unexpe

In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is

Insufficient protection of the inter-process communication functions in ABB System 800xA products OPC Server for AC 800M

HTML attribute value injection vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable

Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute

An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP head

Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inj

Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration per

A vulnerability in the Clientless SSL VPN (WebVPN) of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepow

RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL injection vulnerability. An unauthenticated attacker could

In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2

In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1

Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.

A vulnerability in the web server of Cisco Umbrella could allow an unauthenticated, remote attacker to perform a carriag

GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page.

eramba through c2.8.1 allows HTTP Host header injection with (for example) resultant wkhtml2pdf PDF printing by authenti

In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is

In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sa

In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a malicious plugin autho

In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one alw

In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one

A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject prope

A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.

A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary

A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitra