CWE-138: Improper Neutralization of Special Elements
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- graylog2 graylog2-server Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message 7.5 High
- microsoft 365 copilot chat, 365 copilot's business chat +1 more M365 Copilot Information Disclosure Vulnerability 7.5 High
- microsoft .net, .net 10.0, .net 8.0 +11 more +13 more .NET Spoofing Vulnerability 7.5 High
- cisco secure firewall adaptive security appliance (asa) software, adaptive security appliance software +1 more Cisco Secure Firewall Adaptive Security Appliance SSH Partial Private Key Authentication Bypass Vulnerability 5.3 Medium
- amauric tarteaucitron.js, amauri tarteaucitronjs +1 more tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript 4.2 Medium
- esapi esapi-java-legacy ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special element 6.9 Medium
- meshtastic firmware Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware 5.3 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +17 more +19 more Windows Kernel Elevation of Privilege Vulnerability 7.8 High
- exim Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability 8.1 High
- google chrome Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62... 9.6 Critical
- gitlab URL Redirection to Untrusted Site in GitLab 2.6 Low
- gitlab Improper Validation of Specified Type of Input in GitLab 4.3 Medium
- checkmk Email HTML Injection 6.8 Medium
- leogermani wp users exporter, wp-users-exporter project wp-users-exporter +1 more WP Users Exporter <= 1.4.2 - CSV Injection 6.5 Medium
- homescript ultimate sms notifications for woocommerce Ultimate SMS Notifications for WooCommerce <= 1.4.1 - CSV Injection 6.5 Medium
- dotcms An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can... 9.8 Critical
- palo alto networks pan-os PAN-OS: Improper Neutralization Vulnerability Leads to Unintended Program Execution During Configuration Commit 7.2 High
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite +1 more A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component... 6.1 Medium
- realtek jungle software development kit (sdk), rtl819x jungle software development kit +1 more Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that... 9.8 Critical
- accellion fta Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a... 9.8 Critical
- nagios xi Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the... 8.8 High
- nagios xi Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the... 8.8 High
- nagios xi Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the... 8.8 High
- infinispan Infinispan: Deserialization of untrusted data in the Hot Rod Java client via automatic byte-array deserialization 4.2 Medium