CWE-116: Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Also known as Output Sanitization, Output Validation, Output Encoding.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- coollabs coolifyCoolify Vulnerable to Reflected XSS on Tag Search1.3 Low
mathlivenpmDuplicate Advisory: MathLive's Lack of Escaping of HTML allows for XSS6.3 Medium- ays pro poll makerWordPress Poll Maker Plugin < 5.5.5 - HTML Injection vulnerability5.3 Medium
- katex\htmlData does not validate attribute names in KaTeX6.3 Medium
- gitThe sideband payload is passed unfiltered to the terminal in git7.5 High
- git, debian linux +1 moreNewline confusion in credential helpers can lead to credential exfiltration in git2.1 Low
- git, debian linux +1 moreGit does not sanitize URLs when asking for credentials interactively2.1 Low
- ibm concert, concert software +1 moreIBM Concert Software log manipulation5.4 Medium
kojiPyPIKoji: escape html tag characters in the query string5.4 Medium- xwiki, xwiki xwiki-platform +1 moreXWiki Platform has an SQL injection in getdocuments.vm with sort parameter8.6 High
- apache subversion, debian linux +1 moreApache Subversion: mod_dav_svn denial-of-service via control characters in paths3.1 Low
- No product listedA vulnerability was found in Romain Bourdon Wampserver all versions (discovered in v3.2.3 and v3...7.5 High
- zabbixNew line injection in Zabbix SNMP traps3.7 Low
- google androidIn ArrayConcatVisitor of builtins-array.cc, there is a possible type confusion due to improper...8.8 High
- hashicorp consul, consul enterprise +1 moreConsul L7 Intentions Vulnerable To Headers Bypass8.3 High
- sharp bp-30c25 firmware, bp-30c25t firmware, bp-30c25y firmware +321 more +323 moreSharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow...7.4 High
- mitel micollabA vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab...6.5 Medium
- vilo 5 mesh wifi system, viloliving vilo 5 firmware +1 moreA Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33...5.3 Medium
- docker desktopDocker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view8.9 High
- apache cloudstackApache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructure8.5 High
- rex100 helmholz, helmholz rex100, rex 100 firmware +2 more +4 moreMB connect line/Helmholz: Remote code execution due to improper input validation8.4 High
- the wikimedia foundation mediawiki - css extension, wikimedia mediawiki-extensions-css, wikimedia-extensions-css +2 moreCSS sanitizer used incorrectly, and is easily bypassed6.9 Medium
- librenmsLibreNMS Contains a Stored XSS via File Upload4.6 Medium
- clinical-genomics scoutScout contains insufficient output escaping of attachment names4.6 Medium
- gitlabImproper Encoding or Escaping of Output in GitLab3.1 Low
- envoyproxy envoyMalicious log injection via access logs in envoy6.5 Medium
- veribilim software veribase order, veribase order management +1 moreStored XSS in Veribilim Software's Veribase Order Management9.4 Critical
- apache airflowApache Airflow: Command Injection in an example DAG8.8 High
- alf, alfio-event alf.io +1 morealf.io's preloaded data as json is not escaped correctly6.5 Medium
- kitsada8621 digital library management systemkitsada8621 Digital Library Management System jwt_refresh_token_middleware.go JwtRefreshAuth neutralization for logs6.9 Medium
- google androidIn shouldRestrictOverlayActivities of UsbProfileGroupSettingsManager.java, there is a possible...7.8 High
- microsoft app installerWindows App Installer Spoofing Vulnerability7.8 High
- gitlabImproper Encoding or Escaping of Output in GitLab5.7 Medium
- ibm aspera orchestratorIBM Aspera Orchestrator HTTP header injection5.4 Medium
- boxy studio cookedWordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe Excerpt6.4 Medium
- ibm datacap, datacap navigator +1 moreIBM Datacap Navigator HTTP HOST header injection6.5 Medium
- eximExim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can...5.4 Medium
- apache http server, netapp ontap 9, sonicwall sma 200 firmware +4 more +6 moreApache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.9.1 Critical
- apache http server, netapp clustered data ontap +1 moreApache HTTP Server weakness with encoded question marks in backreferences9.8 Critical
- apache http server, netapp ontap +1 moreApache HTTP Server proxy encoding problem8.1 High
- rordenlab dcm2niixAn issue in dc2niix before v.1.0.20240202 allows a local attacker to execute arbitrary code via...7.8 High
- jupyter server proxy, jupyterhub jupyter-server-proxy, jupyter server proxy +2 moreJupyter Server Proxy has a reflected XSS issue in host parameter9.7 Critical
- php, fedoraproject fedora +1 moreCommand injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)7.7 High
- bitdefender gravityzone, gravityzone console on-premise +1 moreHost whitelist parser issue in GravityZone Console On-Premise (VA-11554)8.1 High
- ethyca fidesPartial Password Exposure Vulnerability in Fides Webserver Logs2.3 Low
- google tink, tink (legacy), tink c\+\+ +2 moreDenial of Service in Tink-cc6.8 Medium
- typo3TYPO3 vulnerable to an HTML Injection in the History Module3.5 Low
- cacti, fedoraproject fedora +1 moreCacti Cross-site Scripting vulnerability when using JavaScript based messaging API5.4 Medium
- gradio project gradioGradio allows credential leakage on Windows7.5 High
- ibm cognos controllerIBM Cognos Controller log injection5.3 Medium
- Show moreLoading…