CWE-116: Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Also known as Output Sanitization, Output Validation, Output Encoding.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- apple icloud, icloud for windows, ios +8 more +10 moreA command injection issue existed in Web Inspector. This issue was addressed with improved...7.8 High
- encode uvicornLog Injection3.7 Low
- sap solution manager, sap se solution manager (trace analysis) +1 moreSAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log...5.3 Medium
- mattermost serverMattermost Server does not neutralize HTML content in an Email template field6.1 Medium
- whitesourcesoftware whitesourceThe dashboard in WhiteSource Application Vulnerability Management (AVM) before version 20.4.1...7.5 High
- phpmailer project phpmailer, canonical ubuntu linux, debian linux +1 more +3 moreInsufficient output escaping of attachment names in PHPMailer7.5 High
- sap se business objects business intelligence platform (cms / auditing issues), sap businessobjects business intelligence platform +1 moreSAP Business Objects Business Intelligence Platform (CMS / Auditing issues), version 4.2, allows...5.3 Medium
- ibm security information queueIBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could allow an...3.0 Low
- mediawikiMediaWiki makeCollapsible allows applying event handler to any CSS selector5.3 Medium
- bitcoin corebitcoind and Bitcoin-Qt prior to 0.17.1 allow injection of arbitrary data into the debug log via...5.3 Medium
- froxlorFroxlor arbitrary code execution via the database configuration options8.8 High
- automattic w3 super cache, super cache plugin cache plugin +1 moreWordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which...8.8 High
- contaoInsert tag injection in the Contao login module5.3 Medium
- sensiolabs symfonyImproper Input Validation in Symfony9.8 Critical
- cisco firepower threat defense software, firepower 4110 firmware, firepower 4115 firmware +7 more +9 moreCisco Firepower Threat Defense Software Multi-instance Container Escape Vulnerabilities8.2 High
- cisco firepower threat defense software, firepower 4110 firmware, firepower 4115 firmware +7 more +9 moreCisco Firepower Threat Defense Software Multi-instance Container Escape Vulnerabilities8.2 High
- apache ofbizAn RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field...9.8 Critical
- gitlabAn issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before...6.1 Medium
- librenmsImproper Encoding or Escaping of Output and Injection in LibreNMS8.8 High
- valvesoftware counter-strike\In Counter-Strike: Global Offensive before 8/29/2019, community game servers can display unsafe...5.3 Medium
- cisco nx-os, nx-os software 6.0(2)a4(1) +1 moreCisco NX-OS Software NX-API Denial of Service Vulnerability5.3 Medium
- document foundation libreofficeInsufficient URL decoding flaw in categorizing macro location7.8 High
- document foundation libreoffice, canonical ubuntu linux, debian linux +2 more +4 moreInsufficient URL encoding flaw in allowed script location check7.8 High
- jenkins configuration as code, jenkins project configuration as code plugin +1 moreImproper Encoding or Escaping of Output in Jenkins Configuration as Code Plugin5.4 Medium
- facebook whatsapp desktop, whatsapp +1 moreAn input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows...5.3 Medium
- cloud foundry uaa release (oss), pivotal software cloud foundry uaa-release +1 moreUAA SQL Identity Zone Vulnerability6.5 Medium
- mozilla firefox, firefox esr, thunderbird +3 more +5 moreA vulnerability exists where the caret ("^") character is improperly escaped constructing some...5.3 Medium
- swift alliance web platformAn issue was discovered in SWIFT Alliance Web Platform 7.1.23. A log injection (and an arbitrary...7.5 High
- my-netdata netdataAn issue was discovered in Netdata 1.10.0. Log Injection (or Log Forgery) exists via a %0a...7.5 High
- microsoft azure devops server, team foundation server, team foundation server 2018 +2 moreAn information disclosure vulnerability exists when Azure DevOps Server and Microsoft Team...6.5 Medium
- microsoft sharepoint enterprise server, sharepoint foundation +1 moreAn information disclosure vulnerability exists when Microsoft SharePoint Server does not properly...6.5 Medium
- eclipse xtend, xtext, the eclipse foundation eclipse xtext +2 morePotentially compromised builds8.1 High
- microsoft azure devops serverA spoofing vulnerability that could allow a security feature bypass exists in when Azure DevOps...6.5 Medium
- openbsd openssh, canonical ubuntu linux, debian linux +20 more +22 moreAn issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display...6.8 Medium
- synology diskstation manager (dsm), diskstation manager +1 moreImproper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager ...5.9 Medium
- microsoft dynamics 365A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) version 8...8.8 High
- dojotoolkit dojo, debian linux +1 moredojox vulnerable to unescaped string injection9.8 Critical
- ledgersmb, pgobject-util-dbadmin project pgobject-util-dbadmin +1 moreThe PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x,...9.8 Critical
- apache juddiThe console in Apache jUDDI 3.0.0 does not properly escape line feeds, which allows remote...6.5 Medium
- sap internet graphics serverUnder certain conditions a malicious user can inject log files of SAP Internet Graphics Server ...5.7 Medium
- red hat, inc. undertow as shipped in jboss eap 7.1.0.ga, redhat jboss enterprise application platform +1 moreImproper Limitation of a Pathname to a Restricted Directory in Jboss EAP Undertow7.5 High
- cisco nx-osA vulnerability in Cisco NX-OS System Software running on Cisco MDS Multilayer Director Switches,...4.2 Medium
- open-emr openemrThe csv_log_html function in library/edihistory/edih_csv_inc.php in OpenEMR 5.0.0 and prior...7.5 High
- accellion file transfer applianceAn issue was discovered on Accellion FTA devices before FTA_9_12_180. seos/1000/find.api allows...9.8 Critical
- git-scm gitcontrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1...8.8 High
- freedesktop polkit, redhat enterprise linux +1 morepkexec, when used with --user nonpriv, allows local users to escape to the parent session via a...7.8 High
- netapp oncommand system managerMultiple functions in NetApp OnCommand System Manager before 8.3.2 do not properly escape special...7.5 High
- f5 nginx, opensuse, suse lifecycle management server +2 more +4 morenginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended...7.5 High