CWE-116: Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Also known as Output Sanitization, Output Validation, Output Encoding.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- mediawiki vector skinAn issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x...6.5 Medium
- php, fedoraproject fedora +1 moreCommand injection via array-ish $command parameter of proc_open()9.4 Critical
- apache zeppelinApache Zeppelin: XSS vulnerability in the helium module6.1 Medium
- apache zeppelinApache Zeppelin: Interpreter download command does not escape malicious code injection9.8 Critical
- ibm app connect enterprise, integration bus +1 moreIBM App Connect Enterprise and IBM Integration Bus for z/OS information disclosure4.9 Medium
- katexKaTeX's \includegraphics does not escape filename6.3 Medium
- openstack murano, yaql +1 moreInformation leakage in YAQL6.5 Medium
- postalserver postalSMTP Smuggling in Postal5.3 Medium
- ibm aspera faspexIBM Aspera Faspex HTTP header injection5.4 Medium
- greenpau caddy-securityImproper Neutralization of HTTP Headers in github.com/greenpau/caddy-security4.3 Medium
- redhat ansible, fedoraproject fedora, red hat ansible automation platform 2.4 for rhel 8 +7 more +9 moreAnsible-core: possible information leak in tasks that ignore ansible_no_log configuration5.0 Medium
- arcadia technology, llc crafty controllerImproper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 47.5 High
- ibm tivoli application dependency discovery managerIBM Tivoli Application Dependency Discovery Manager HOST header injection10.0 Critical
- kuerp project kuerpSichuan Yougou Technology KuERP log neutralization for logs6.3 Medium
- dell unity, unity operating environment, unity xt operating environment +1 more +3 moreDell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed...3.1 Low
- comex shlexMultiple issues involving quote API in shlex3.2 Low
- intel nuc bios firmware nuc bios firmware, intel nuc 7 essential nuc7cjysamn firmware, nuc kit nuc7cjyh firmware +4 more +6 moreImproper input validation for some Intel NUC BIOS firmware before version JY0070 may allow a...7.5 High
- integration objects opc ua server toolkitIntegration Objects OPC UA Server Toolkit Improper Output Neutralization for Logs5.3 Medium
- ashanjay eventonEventON (Free < 2.2.8, Premium < 4.5.5) - Reflected XSS6.1 Medium
- ashanjay eventonEventON (Free < 2.2.7, Premium < 4.5.5) - Admin+ Stored Cross-Site Scripting4.8 Medium
- huawei emui, harmonyos +1 moreVulnerability of parameters being not verified in the WMS module. Successful exploitation of this...7.5 High
- huawei emui, harmonyos +1 moreDenial of Service (DoS) vulnerability in the DMS module. Successful exploitation of this...7.5 High
- gofiber django, template +1 moreDjango Template Engine Vulnerable to XSS9.3 Critical
- lockss classic lockss daemonlockss-daemon (aka Classic LOCKSS Daemon) before 1.77.3 performs post-Unicode normalization,...5.3 Medium
- haproxyHAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers...8.2 High
- ibm qradar wincollect agent, qradar wincollect +1 moreIBM QRadar WinCollect Agent improper output encoding3.3 Low
- misp-project mispAn issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php...9.8 Critical
- opennds captive portalAn issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape...9.8 Critical
- mattermostPassword hash in response body after username update4.9 Medium
- liquidfilesHTML and SMTP Injection in LiquidFiles5.4 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki users can be tricked to execute scripts as the create page action doesn't display the page's title9.1 Critical
- iterm2iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain...9.8 Critical
- iterm2iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain...9.8 Critical
- meta react developer tools extension, facebook react-devtools +1 moreReact Developer Tools extension Improper Authorization vulnerability6.5 Medium
- schollz crocCroc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device7.8 High
- shirasagiLate-Unicode normalization vulnerability in SHIRASAGI5.3 Medium
- wftpserver wing ftp server, wing ftp server ftp server +1 moreCross-Site Scripting Vulnerability in Wing FTP Server <= 7.2.03.0 Low
- splunk it service intelligence, itsi +1 moreUnauthenticated Log Injection in Splunk IT Service Intelligence (ITSI)8.6 High
- docker machineDocker Machine through 0.16.2 allows an attacker, who has control of a worker node, to provide...6.5 Medium
- huawei emui, harmonyos +1 moreVulnerability of input parameter verification in certain APIs in the window management module....7.5 High
- huawei emui, harmonyos +1 moreVulnerability of input parameters being not strictly verified in the PMS module. Successful...7.5 High
- huawei emui, harmonyos +1 moreInput verification vulnerability in the audio module. Successful exploitation of this...7.5 High
- huawei emui, harmonyos +1 moreInput verification vulnerability in the storage module. Successful exploitation of this...7.5 High
- google crittersXSS in Chrome Lab Critters5.7 Medium
- intel converged security management engine firmware, intel and intel standard manageability in intel csme and intel standard manageability in intel csme +1 moreImproper input validation in some firmware for Intel(R) AMT and Intel(R) Standard Manageability...8.6 High
- openzeppelin contracts, openzeppelin-contracts, contracts-upgradable +2 moreOpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender5.3 Medium
- prestashopPrestaShop XSS vulnerability through Validate::isCleanHTML method8.3 High
- splunk soar, soar (cloud), soar (on-premises) +2 moreUnauthenticated Log Injection In Splunk SOAR8.6 High
- gxsoftware xperiencentralInteractive Forms (IAF) in GX Software XperienCentral versions 10.33.1 until 10.35.0 was...7.5 High
- envoyproxy envoyEnvoy vulnerable to OAuth2 credentials exploit with permanent validity8.6 High
- Show moreLoading…