CWE-116: Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Also known as Output Sanitization, Output Validation, Output Encoding.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- rtx trap project trapRTX TRAP v1.0 was discovered to be vulnerable to host header poisoning.6.1 Medium
- spring hateoas, vmware spring hateoas +1 moreForwarded header exploit with Spring HATEOAS on WebFlux5.3 Medium
- froxlor, froxlor froxlor/froxlor +1 moreImproper Encoding or Escaping of Output in froxlor/froxlor9.1 Critical
- honeywell c300, c300 firmware +1 moreController stack overflow when decoding messages from the server9.8 Critical
- gitlabImproper Encoding or Escaping of Output in GitLab4.1 Medium
- sap solution manager, sap se solution manager (diagnostic agent) +1 moreHeader Injection in SAP Solution Manager (Diagnostic Agent)7.2 High
- sap enable nowInformation Disclosure in SAP Enable Now5.3 Medium
- nilsteampassnet nilsteampassnet/teampass, teampass +1 moreImproper Encoding or Escaping of Output in nilsteampassnet/teampass7.6 High
- rails action packActionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to4.0 Medium
- discourseDiscourse's canonical url not being used for topic embeddings3.1 Low
- nilsteampassnet nilsteampassnet/teampass, teampass +1 moreImproper Encoding or Escaping of Output in nilsteampassnet/teampass3.5 Low
- splunk, splunk enterprise, universal forwarder +2 moreUnauthenticated Log Injection in Splunk Enterprise8.6 High
- hitachi energy foxman-un, unem +1 moreA vulnerability exists in a FOXMAN-UN and UNEM logging component, it only affects systems that...4.0 Medium
- webassembly binary toolkitWebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@'...5.5 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to RXSS via editor parameter - importinline template9.1 Critical
- mutagen, mutagen compose +1 moreMutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints3.0 Low
- mozilla firefox, firefox for android, focus +2 more +4 moreAn attacker could have caused memory corruption and a potentially exploitable use-after-free of a...8.8 High
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreFirefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be...8.8 High
- acymailing, acymailing newsletter plugin for joomla in the enterprise version +1 moreStored XSS affecting the AcyMailing plugin for Joomla7.2 High
- pdfzorroPDFZorro PDFZorro Online r20220428 using TCPDF 6.2.5, despite having workflows claiming to...7.5 High
- cmder, maximus5 conemu +1 moreConEmu through 220807 and Cmder before 1.3.21 report the title of the terminal, including control...9.8 Critical
- fortra cobalt strikeCobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing...9.8 Critical
- flatpakFlatpak metadata with ANSI control codes can cause misleading terminal output5.0 Medium
- sudo project sudo, netapp active iq unified manager +1 moreSudo before 1.9.13 does not escape control characters in sudoreplay output.5.3 Medium
- sudo project sudo, netapp active iq unified manager +1 moreSudo before 1.9.13 does not escape control characters in log messages.5.3 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile10.0 Critical
- redhat keycloak, red hat single sign-on 7, single sign-on 7.6 for rhel 7 +3 more +5 moreKeycloak: reflected xss attack8.1 High
- schneider electric clearscada, ecostruxure geo scada expert 2019, ecostruxure geo scada expert 2020 +1 more +3 moreA CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the...5.3 Medium
- gnu emacsAn issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection...7.8 High
- intel c\+\+ compiler classicImproper handling of Unicode encoding in source code to be compiled by the Intel(R) C++ Compiler...8.3 High
- dell data protection central, emc data protection central, dp4400 firmware +1 more +3 moreDell EMC Data Protection Central, versions 19.1 through 19.7, contains a Host Header Injection...5.4 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMalicious command could be hidden in devtools output on Windows6.5 Medium
- gitlearn project gitlearngitlearn Escape Sequence config.sh getOutOf injection5.4 Medium
- apache tomcatApache Tomcat: JsonErrorReportValve escaping7.5 High
- cisco openresolveOpenDNS OpenResolve endpoints.py neutralization for logs4.6 Medium
- docomo \+ message, kddi corporation, ntt docomo, inc., and softbank corp. +message app for android and for ios, ntt docomo +message app for android and for ios, and softbank +message app for android and for ios +1 moreKDDI +Message App, NTT DOCOMO +Message App, and SoftBank +Message App contain a vulnerability...5.4 Medium
- ibm cognos analyticsIBM Cognos Analytics data manipulation6.5 Medium
- ibm api connectIBM API Connect HOST header injection5.4 Medium
- parallels remote application serverThe Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header...8.1 High
- xwiki, xwiki xwiki-platform +1 moreImproper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-menu-ui9.9 Critical
- fivestarplugins five star restaurant reservationsFive Star Restaurant Reservations < 2.4.12 - Unauthenticated Arbitrary Payment Status Update to Stored XSS6.1 Medium
- simple history project history, unspecified simple history plugin +1 moreSimple History Plugin Header neutralization for logs6.5 Medium
- ibm cics txIBM CICS TX information disclosure3.7 Low
- activity log project log, unspecified activity log plugin +1 moreActivity Log Plugin HTTP Header neutralization for logs5.3 Medium
- apache heron, apache software foundation heron (incubating) +1 moreCRLF log injection9.8 Critical
- phpipamphpipam v1.5.0 was discovered to contain a header injection vulnerability via the component ...9.8 Critical
- kitty project kitty, fedoraproject fedora +1 moreIn Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can...7.8 High
- owasp modsecurity core rule set, debian linux, fedoraproject fedora +2 moreResponse body bypass in OWASP ModSecurity Core Rule Set via repeated HTTP Range header submission with a small byte range7.5 High
- owasp modsecurity core rule set, debian linux, fedoraproject fedora +2 moreResponse body bypass in OWASP ModSecurity Core Rule Set via a specialy crafted charset in the HTTP Accept header7.3 High
- owasp modsecurity core rule set, debian linux, fedoraproject fedora +2 morePartial rule set bypass in OWASP ModSecurity Core Rule Set for HTTP multipart requests using character encoding in the Content-Type or Content-Transfer-Encoding header7.3 High
- Show moreLoading…