CWE-117: Improper Output Neutralization for Logs
The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
Also known as Log forging.
A kind of CWE-116 Improper Encoding or Escaping of Output.
From the CWE List. © The MITRE Corporation.
Newest
- invoiceplaneInvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning9.1 Critical
openclawnpmOpenClaw log poisoning (indirect prompt injection) via WebSocket headers3.1 Low- ibm mq operator, supplied mq advanced container images +1 moreMultiple vulnerabilities in IBM MQ Operator and Queue manager container images4.0 Medium
- red hat build of keycloak, build of keycloak 26.4.2 +1 moreKeycloak-services: sensitive headers shown in the http access logs5.0 Medium
- neo4j community edition, neo4j, neo4j enterprise edition +2 moreInsufficient escaping of unicode characters in query log1.1 Low
- yhirose cpp-httplibcpp-httplib Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP Trust5.3 Medium
- splunk, splunk cloud platform, enterprise +2 moreUnauthenticated Log Injection in Splunk Enterprise5.3 Medium
- ibm concertIBM Concert Improper Log Neutralization6.2 Medium
- sminozzi site checkup debug ai troubleshooting with wizard and tips for each issueSite Checkup AI Troubleshooting with Wizard and Tips for Each Issue <= 1.47 - Unauthenticated Log File Poisoning6.5 Medium
- ibm concert, concert software +1 moreMultiple Vulnerabilities in IBM Concert Software.5.3 Medium
- No product listedCubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into...8.2 High
- sick enterprise analyticsInjection via log file6.5 Medium
- hitachi energy asset suiteA vulnerability exists in Asset Suite for an authenticated user to manipulate the content of...6.0 Medium
- jenkinsJenkins has a log message injection vulnerability5.3 Medium
- apache log4cxxApache Log4cxx: Improper HTML escaping in HTMLLayout2.1 Low
- apache log4cxxApache Log4cxx: Improper escaping with JSONLayout6.3 Medium
- red hat openshift pipelines, advanced cluster management for kubernetes 2, advanced cluster security 4 +12 more +14 moreGithub.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure5.3 Medium
- advanced intrusion detection environment project intrusion detection environment, aide +1 moreAIDE improper output neutralization vulnerability6.2 Medium
litestarPyPILitestar has potential log injection in exception logging3.7 Lowms-swiftPyPIMS SWIFT WEB-UI RCE Vulnerability5.1 Medium- apache struts extrasApache Struts Extras: Improper Output Neutralization for Logs6.5 Medium
- wireapp wire-ioswire-ios accidentally logs message contents4.1 Medium
- djangoproject django, debian linux +1 moreDjango Improper Output Neutralization for Logs vulnerability4.0 Medium
- abb aspect-enterprise, matrix series, nexus series +2 moreLog Forging6.9 Medium
- tridium niagara, niagara enterprise security, niagara framework +2 moreImproper Output Neutralization for Logs4.3 Medium
- appleple a-blog cmsa-blog cms multiple versions neutralize logs improperly. If this vulnerability is exploited with...2.1 Low
- tenable nessusLog Poisoning in Nessus4.3 Medium
- fortinet fortianalyzer, fortimanager +1 moreAn Improper Output Neutralization for Logs vulnerability [CWE-117] in FortiAnalyzer version 7.6.1...5.0 Medium
- berriai berriai/litellm, litellm +1 moreImproper Output Neutralization for Logs in berriai/litellm7.5 High
- danny-avila danny-avila/librechat, librechat +1 moreLogs Debug Injection in danny-avila/librechat4.3 Medium
- envoyproxy gatewayEnvoy Gateway Log Injection Vulnerability5.3 Medium
- rackEscape Sequence Injection vulnerability in Rack lead to Possible Log Injection6.9 Medium
- dario health application database and internet-based server infrastructure, usb-c blood glucose monitoring system starter kit android applications +1 moreDario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Improper Output Neutralization For Logs6.9 Medium
- ibm openpages with watsonIBM OpenPages log manipulation5.3 Medium
- rackPossible Log Injection in Rack::CommonLogger5.7 Medium
- ibm aspera sharesIBM Aspera Shares Data Manipulation5.3 Medium
- red hat openshift service mesh 2Envoyproxy: openshift service mesh 2.6.3 and 2.5.6 envoy header handling allows log injection and potential spoofing4.3 Medium
- ibm maximo application suiteIBM Maximo Application Suite log manipulation5.3 Medium
- ibm concert, concert software +1 moreIBM Concert Software log manipulation5.4 Medium
- axis camera station proSeth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible...6.3 Medium
- phpPHP-FPM logs from children may be altered3.3 Low
- microsoft power platform terraform provider, terraform-provider-power-platform, terraform provider power platform +2 morePower Platform Terraform Provider has Improper Masking of Secrets in Logs8.8 High
- envoyproxy envoyMalicious log injection via access logs in envoy6.5 Medium
- master-nan sweet-cms, sweetcms +1 moremaster-nan Sweet-CMS log.go LogHandler neutralization for logs5.3 Medium
- kitsada8621 digital library management systemkitsada8621 Digital Library Management System jwt_refresh_token_middleware.go JwtRefreshAuth neutralization for logs6.9 Medium
- gallagher command centreImproper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint...3.3 Low
- nvidia triton inference serverCVE4.3 Medium
- italtel embraceAn issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly...5.3 Medium
- ibm cognos controllerIBM Cognos Controller log injection5.3 Medium
- triangle microworks scada data gatewayTriangle MicroWorks SCADA Data Gateway Event Log Improper Output Neutralization For Logs Arbitrary File Write Vulnerability4.4 Medium
- Show moreLoading…