CWE-116: Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Also known as Output Sanitization, Output Validation, Output Encoding.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Wiki UI Main Wiki Eval Injection vulnerability9.9 Critical
- redhat ansible runneransible-runner vulnerable to shell command injection7.8 High
- omniauthOmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value9.8 Critical
- fusionpbxFusionPBX 5.0.1 was discovered to contain a command injection vulnerability via /fax/fax_send.php.9.8 Critical
- google chrome, fedoraproject fedora +1 moreInsufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79...4.3 Medium
- fifu featured image from url, marceljm featured image from url (fifu) +1 moreFeatured Image from URL < 4.0.0 - Arbitrary Settings Update to Stored XSS via CSRF6.1 Medium
- webminsoftware/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.9.8 Critical
- automattic woocommerceWooCommerce < 6.6.0 - Admin+ Stored HTML Injection4.8 Medium
- verizon lvskihp outdoorunit firmwareVerizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled...8.8 High
- verizon lvskihp outdoorunit firmwareVerizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled...9.8 Critical
- siemens simatic cp 1242-7 v2, simatic cp 1243-1, simatic cp 1243-7 lte eu +27 more +29 moreA vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions), SIMATIC CP 1243-1 ...8.4 High
- google androidIn choosePrivateKeyAlias of KeyChain.java, there is a possible access to the user's certificate...5.5 Medium
- apache sling api, sling commons log, apache software foundation sling +2 morelog injection in Sling logging5.3 Medium
- motor-admin, getmotoradmin motor admin +1 moremotoradmin - host header Injection in the reset password functionality6.8 Medium
- xwiki, xwiki xwiki-platform +1 moreCross-site Scripting in Filter Stream Converter Application in XWiki Platform7.4 High
- xwiki, xwiki xwiki-platform +1 moreCross-site Scripting in the Flamingo theme manager7.4 High
- xwiki, xwiki xwiki-platform +1 moreCross-site Scripting in XWiki Platform Wiki UI Main Wiki7.4 High
- apache software foundation maven, apache maven shared utils, debian linux +2 moreCommandline class shell injection vulnerabilities9.8 Critical
- jenkins random string parameter, jenkins project random string parameter plugin +1 moreCross-site Scripting in Jenkins Random String Parameter Plugin5.4 Medium
- crafter software cms, craftercms crafter cms +1 moreImproper Output Neutralization for Logs in Crafter Studio4.3 Medium
- giteaShell command injection in gitea7.5 High
- ibm guardium data encryptionIBM Guardium Data Encryption (GDE) 4.0.0 and 5.0.0 prepares a structured message for...3.0 Low
- ibm maximo asset management, maximo application suite +1 moreIBM Maximo Asset Management 7.6.1.1 and 7.6.1.2 is vulnerable to HTTP header injection, caused by...5.4 Medium
- livehelperchat livehelperchat/livehelperchat, live helper chat +1 moreHost Header injection in password Reset in livehelperchat/livehelperchat8.8 High
- mozilla firefoxSVG's <code><use></code> element could have been used to load unexpected content that could...8.8 High
- dcnglobal s4600-10p-si firmwareAn issue was discovered on DCN (Digital China Networks) S4600-10P-SI devices before R0241.0470....7.4 High
- gitlabImproper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed...5.8 Medium
- takanakui menu image, icons made easy, freshlightlab menu image\, icons made easy +1 moreMenu Image, Icons made easy < 3.0.8 - Subscriber+ Stored Cross-Site Scripting5.4 Medium
- beekeeperstudio beekeeper-studioA remote code execution (RCE) vulnerability in Beekeeper Studio v3.2.0 allows attackers to...9.8 Critical
- fedoraproject fedora, nicotine-plus nicotine\+ +1 moreNicotine+ DoS on Null Character in Download Request7.5 High
- ibm spectrum copy data managementIBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to HTTP header injection...4.8 Medium
- sedlex simple quotationSimple Quotation <= 1.3.2 - Quote Creation/Edition via CSRF to Stored Cross-Site Scripting6.1 Medium
- yokogawa centum cs 3000, exaopc, yokogawa electric corporation centum vp +4 more +6 moreCAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly...8.1 High
- osu ohio supercomputer center open ondemandThe Job Composer app in Ohio Supercomputer Center Open OnDemand before 1.7.19 and 1.8.x before 1...4.3 Medium
- libexpat project libexpat, debian linux, fedoraproject fedora +6 more +8 morexmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as...9.8 Critical
- compassplus tranzware online, tranzware online financial institution maintenance interface +1 moreA Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface...6.1 Medium
- xwiki, xwiki xwiki-platform +1 morePath traversal in xwiki-platform-skin-skinx6.8 Medium
- synacor zimbra collaboration suite, zimbra collaborate suite (zcs) +1 moreAn issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15...6.1 Medium
- unknown wordpress gdpr, welaunch wordpress gdpr\&ccpa +1 moreWordPress GDPR & CCPA < 1.9.27 - Unauthenticated Reflected Cross-Site Scripting6.1 Medium
- itunesrpc-remastered project itunesrpc-remasteredCode injection in iTunesRPC-Remastered9.9 Critical
- westerndigital my cloud osCommand Injection Remote Code Execution vulnerability on Western Digital My Cloud devices.7.8 High
- coins-global coins construction cloudAn issue was discovered in COINS Construction Cloud 11.12. Due to improper validation of user...6.5 Medium
- moodleMoodle Improper Encoding or Escaping of Output4.9 Medium
- buffercode random banner, random banner banner +1 moreRandom Banner <= 4.1.4 Admin+ Stored Cross-Site Scripting4.8 Medium
- gitlabAn issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3...4.3 Medium
- ibm cloud pak for automationIBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is...5.4 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped...8.8 High
- uipath assistantAn issue was discovered in UiPath Assistant 21.4.4. User-controlled data supplied to the -...9.8 Critical
- kyma-project kymaDue to insufficient input validation of Kyma, authenticated users can pass a Header of their choice and escalate privileges which can completely compromise the cluster.8.8 High
- Show moreLoading…