CWE-116: Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Also known as Output Sanitization, Output Validation, Output Encoding.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- huawei ecns280 td firmwareThere is an information leak vulnerability in eCNS280_TD V100R005C10SPC650. The vulnerability is...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInsufficient data validation in new tab page in Google Chrome prior to 96.0.4664.93 allowed a...6.5 Medium
- apache airavata django portalairavata-django-portal allows CRLF log injection because of the lack of escaping in the log statements5.3 Medium
- ntt-west biz box nvr510 firmware, biz box nvr700w firmware, biz box rtx1210 firmware +6 more +8 moreImproper neutralization of HTTP request headers for scripting syntax vulnerability in the Web GUI...5.7 Medium
- apache supersetPossible log injection6.5 Medium
- thunderdome planning poker, stevenweathers thunderdome-planning-poker +1 moreImproper Neutralization of Special Elements used in an LDAP Query8.1 High
- google androidIn onCreate of CompanionDeviceActivity.java or DeviceChooserActivity.java, there is a possible...8.0 High
- redon-tech roblox-purchasing-hub, redon roblox purchasing hub +1 moreAPI giving out files without key7.5 High
- ome omero-web, openmicroscopy omero-figure +1 moreInconsistent input sanitisation leads to XSS vectors9.8 Critical
- jenkins git, jenkins project git plugin +1 moreStored XSS vulnerability in Jenkins Git Plugin6.1 Medium
- sap contact centerDue to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an...9.6 Critical
- pimcoreImproper Encoding or Escaping of Output in Asset Metadata Component8.0 High
- canon oce print exec workgroupCanon Oce Print Exec Workgroup 1.3.2 allows Host header injection.5.3 Medium
- gitlabUnder very specific conditions a user could be impersonated using Gitlab shell. This...3.1 Low
- exponentcmsA HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php. A...4.3 Medium
- mitel micollabThe MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get...6.5 Medium
- mitel micollabThe MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to...6.5 Medium
- google chrome, fedoraproject fedora +1 moreInsufficient validation of untrusted input in Sharing in Google Chrome prior to 92.0.4515.107...4.3 Medium
- tekmonks monkshuImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') and Improper Encoding or Escaping of Output in frontend/server/server.js4.6 Medium
- gtranslate, translate ai multilingual solutions gtranslate pro and gtranslate enterprise +1 moreReflected XSS in GTranslate Pro and GTranslate Enterprise < 2.8.655.0 Medium
- xmldomMisinterpretation of malicious XML input in xmldom6.5 Medium
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreServer log entry spoofing via newline injection5.3 Medium
- apache tomcat, debian linux, oracle communications cloud native core policy +4 more +6 moreAuth weakness in JNDIRealm6.5 Medium
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreFilenames not escaped by default in controllers using DownloadResponse3.5 Low
- gallagher command centreImproper Encoding or Escaping in Gallagher Command Centre Server allows a Command Centre Operator...8.1 High
- keycloakkeycloak Self Stored Cross-site Scripting vulnerability9.6 Critical
- squid-cache squid, debian linux, fedoraproject fedora +1 more +3 moreAn issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug...6.5 Medium
- squid-cache squid, debian linux, fedoraproject fedora +2 moreModerate: squid:4 security, bug fix, and enhancement update6.5 Medium
- ibm spectrum scale, gpfs.tct.server +1 moreIBM Spectrum Scale 1.1.1.0 through 1.1.8.4 Transparent Cloud Tiering could allow a remote...4.0 Medium
- gin-gonic gin, github.com/gin-gonic/gin +1 moreArbitrary log line injection in github.com/gin-gonic/gin7.5 High
- magpierss project magpierssBecause of a incorrect escaped exec command in MagpieRSS in 0.72 in the /extlib/Snoopy.class.inc...9.8 Critical
- ipfs go-ipfsControl character injection in console output6.8 Medium
- secomea gatemanager, gatemanager 4250 firmware, gatemanager 4260 firmware +2 more +4 moreCSV Formula Injection possible due to improper fields escaping in GateManager3.5 Low
- ibm security verify information queueIBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user to perform unauthorized...3.1 Low
- ninjaforms ninja formsThe Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.5.3 Medium
- xwikiImproper escaping in XWiki Platform7.5 High
- mediawiki, debian linux, fedoraproject fedora +2 moreIn MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can...7.5 High
- spipA PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP...8.8 High
- bigbluebuttonweb/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter...5.3 Medium
- semantic-releaseSecret disclosure in semantic-release8.1 High
- fruitywifi project fruitywifiA remote code execution vulnerability is identified in FruityWifi through 2.4. Due to improperly...8.8 High
- ansible collections project community.crypto, ansible community community collections +1 moreA flaw was found in Ansible Collection community.crypto. openssl_privatekey_info exposes private...7.5 High
- bigbluebuttonBigBlueButton before 2.3 does not implement LibreOffice sandboxing. This might make it easier for...6.5 Medium
- hcltech appscan"HCL AppScan Enterprise security rules update administration section of the web application...7.5 High
- python, canonical ubuntu linux, debian linux +8 more +10 morehttp.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x...7.2 High
- mitel micloud management portalMitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted...5.3 Medium
- red hat ansible, debian linux, redhat ansible engine +2 moreImproper Output Neutralization and Improper Encoding or Escaping of Output for Logs in ansible5.0 Medium
- sap netweaver application server java, sap se netweaver as java (xml forms) +1 moreSAP NetWeaver Application Server JAVA(XML Forms) versions 7.30, 7.31, 7.40, 7.50 does not...5.4 Medium
- kleopatra project kleopatra, fedoraproject fedora, opensuse backports sle +1 more +3 moreThe Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to...8.8 High
- rangee rangeeosThe Kommbox component in Rangee GmbH RangeeOS 8.0.4 could allow a local authenticated attacker to...7.8 High
- Show moreLoading…