CWE-176: Improper Handling of Unicode Encoding
The product does not properly handle when an input contains Unicode encoding.
A kind of CWE-172 Improper Encoding or Decoding of Data.
From the CWE List. © The MITRE Corporation.
Newest
- openwallet-foundation @sd-jwt/core, @sd-jwt/decode +1 more SD JWT JS: Tampered disclosures silently dropped instead of rejected 7.1 High
- netty netty-tcnative, netty-tcnative-boringssl-static +1 more Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding 6.9 Medium
- vyperlang vyper Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters 6.0 Medium
-
libcpanel-json-xs-perlDebian,perl-Cpanel-JSON-XSMageia +1 more Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp 7.5 High -
libcpanel-json-xs-perlDebian,perl-Cpanel-JSON-XSAzure Linux +1 more Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv 6.5 Medium - progress moveit transfer MOVEit Transfer Email MFA Bypass 7.5 High
- apache log4net Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch 5.3 Medium
-
libnet-whois-raw-perlDebian,perl-Net-Whois-RawMageia +1 more Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names 5.4 Medium - watchguard fireware, fireware os +1 more Fireware OS Improper Authorization in Access Portal Reverse Proxy 5.3 Medium
- libexpat Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate 8.7 High
- garycourt uri-js uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars 6.9 Medium
- open-telemetry opentelemetry-go OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation 5.1 Medium
- hashicorp go-slug Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions 5.5 Medium
- pypa setuptools setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+ 6.1 Medium
- deno Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) 7.3 High
- sqlite sqldiff, siemens ruggedcom crossbow station access controller (sac) +1 more SQLite sqldiff remote code execution via argument injection 9.2 Critical
- caddyserver caddy Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files 8.1 High
- php frankenphp FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files 8.1 High
- protobufjs project protobufjs, protobufjs protobuf.js +1 more protobufjs: Overlong UTF-8 decoding 5.3 Medium
- rrwo text::minify::xs, text\ +1 more Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have heap overflow when processing some malformed UTF-8 characters 7.5 High
- uutils coreutils uutils coreutils split Local Data Integrity Issue via Lossy Filename Encoding 3.3 Low
- uutils coreutils uutils coreutils ln Local Denial of Service via Improper Handling of Non-UTF-8 Filenames 3.3 Low
- uutils coreutils uutils coreutils comm Silent Data Corruption via Lossy UTF-8 Normalization 3.3 Low
- nodejs node, node.js, red hat enterprise linux 10 +4 more +6 more A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead... 7.7 High
- splunk, splunk cloud platform, enterprise +2 more Improper Input Validation during User Account Creation in Splunk Enterprise 6.6 Medium
- sonicwall sma1000, sma6200 firmware, sma6210 firmware +3 more +5 more Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote... 7.2 High
- sonicwall sma1000, sma6200 firmware, sma6210 firmware +3 more +5 more Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote... 6.6 Medium
- toddr xml::parser, xml\ +1 more XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes 7.5 High
-
openclawnpm OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists 6.9 Medium - litestar FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD) 6.5 Medium
- isaacs node-tar, tar, red hat confidential compute attestation +37 more +39 more node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS 8.8 High
- aquaplatform revive adserver, revive adserver +1 more HackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive... 5.4 Medium
- dnnsoftware dotnetnuke, dnn.platform +1 more DNN's CKEditor File Uploader functionality vulnerable through Unicode obfuscation 5.3 Medium
- android framework, google android +1 more In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path... 7.3 High
- tukaani xz XZ Utils on Microsoft Windows platform are vulnerable to argument injection 6.3 Medium
- helix core, perforce helix core +1 more Unicode "best fit" argument injection 5.8 Medium
- microsoft windows Some Microsoft technologies as used in Windows 8 through 11 allow a temporary client-side... No score
- zoom, zoom video communications, inc. desktop client for windows, zoom vdi client for windows, and zoom meeting sdk for windows, zoom meeting software development kit +2 more +4 more Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input Validation 9.6 Critical
- ewen-lbh ffcss, firefox css +1 more ewen-lbh/ffcss late-Unicode normalization vulnerability 5.3 Medium
- shirasagi Late-Unicode normalization vulnerability in SHIRASAGI 5.3 Medium
- schweitzer engineering laboratories sel-5030 acselerator quickset software, selinc sel-5030 acselerator quickset +1 more Improper Handling of Unicode Encoding 4.8 Medium
- zoom, zoom video communications, inc. desktop client for windows and zoom vdi client, zoom virtual desktop infrastructure +2 more Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI... 9.6 Critical
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode... 2.3 Low
- google tink, tink java +1 more Ciphertext integrity weakness in Tink 5.3 Medium