CWE-116 Archives - CVE Vulnerability

CVE-2008-5573

Sun, 26 Feb 2023 09:11:05 +0000

SQL injection vulnerability in the login feature in Poll Pro 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) Password and (2) username parameters.

The post CVE-2008-5573 appeared first on CVE Vulnerability.

CVE-2008-4636

Sun, 26 Feb 2023 09:10:38 +0000

yast2-backup 2.14.2 through 2.16.6 on SUSE Linux and Novell Linux allows local users to gain privileges via shell metacharacters in filenames used by the backup process.

The post CVE-2008-4636 appeared first on CVE Vulnerability.

CVE-2008-3773

Sun, 26 Feb 2023 09:10:11 +0000

Cross-site scripting (XSS) vulnerability in vBulletin 3.7.2 PL1 and 3.6.10 PL3, when “Show New Private Message Notification Pop-Up” is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a private message subject (aka newpm[title]).

The post CVE-2008-3773 appeared first on CVE Vulnerability.

CVE-2008-0769

Sun, 26 Feb 2023 09:08:42 +0000

Cross-site scripting (XSS) vulnerability in Livelink ECM 9.0.0 through 9.7.0 and possibly earlier does not set the charset, which allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded input.

The post CVE-2008-0769 appeared first on CVE Vulnerability.

CVE-2008-0757

Sun, 26 Feb 2023 09:08:41 +0000

Cross-site scripting (XSS) vulnerability in index.php in MercuryBoard 1.1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter (aka the message text area), which leads to an injection in the messenger during private message (PM) preview. NOTE: some of these details are obtained from third party information.

The post CVE-2008-0757 appeared first on CVE Vulnerability.

CVE-2008-0005

Sun, 26 Feb 2023 09:08:21 +0000

mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.

The post CVE-2008-0005 appeared first on CVE Vulnerability.

CVE-2018-9246

Sun, 26 Feb 2023 06:51:46 +0000

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create(), run_file(), backup(), or restore() function. The vulnerability allows unauthorized users to execute code with the same privileges as the running application.

The post CVE-2018-9246 appeared first on CVE Vulnerability.

CVE-2018-8920

Sun, 26 Feb 2023 06:51:39 +0000

Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbitrary content to have an unspecified impact by exporting an archive in CSV format.

The post CVE-2018-8920 appeared first on CVE Vulnerability.

CVE-2018-8609

Sun, 26 Feb 2023 06:51:33 +0000

A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) version 8 when the server fails to properly sanitize web requests to an affected Dynamics server, aka “Microsoft Dynamics 365 (on-premises) version 8 Remote Code Execution Vulnerability.” This affects Microsoft Dynamics 365.

The post CVE-2018-8609 appeared first on CVE Vulnerability.

CVE-2018-2389

Sun, 26 Feb 2023 06:49:00 +0000

Under certain conditions a malicious user can inject log files of SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, hiding important information in the log file.

The post CVE-2018-2389 appeared first on CVE Vulnerability.