CWE-790: Improper Filtering of Special Elements
The product receives data from an upstream component, but it does not filter or incorrectly filters special elements before sending it to a downstream component.
A kind of CWE-138 Improper Neutralization of Special Elements.
From the CWE List. © The MITRE Corporation.
Newest
- isc bind, bind 9 +1 more Potential wildcard CNAME RPZ policy bypass 7.5 High
- rrwo plack::middleware::security::common Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths 7.3 High
- wago device sphere, solution builder +1 more Backend Access Due to Insufficient Input Validation 7.5 High
- ericsson indoor connect 8855, indoor connect 8855 firmware +1 more Ericsson Indoor Connect 8855 - Improper Filtering of Special Elements Vulnerability 7.2 High
- freebsd Jail chroot escape via fd exchange with a different jail 7.5 High
- proofpoint enterprise protection Enterprise Protection Backslash URL Rewrite Bypass 5.8 Medium
- dell recoverpoint for virtual machines Dell RecoverPoint for Virtual Machines 6.0.x contains Denial of Service vulnerability. A User... 4.4 Medium
- freebsd Multiple issues in ctl(4) CAM Target Layer 8.8 High
- otrs ag ((otrs)) community edition, otrs +1 more Stored XSS in process management 4.9 Medium
- otrs ag ((otrs)) community edition, otrs +1 more Stored XSS in System Configuration 4.9 Medium
- otrs Information exlosure in external interface 5.7 Medium
- ruijienetworks rg-rsr10-01g-t, rg-rsr10-01g-t firmware +1 more An issue discovered in RG-RSR10-01G-T(W)-S and RG-RSR10-01G-T(WA)-S routers with firmware version... 8.8 High
- facebook tac plus, fedoraproject fedora +1 more A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr, or NAC address sent… 9.8 Critical
- feathers-sequalize sequelize.js, sequelizejs sequelize +1 more Sequalize - Default support for “raw attributes” when using parentheses 10.0 Critical
- oracle access manager, fusion middleware +1 more Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:... 9.8 Critical
- etherpad, ether etherpad-lite +1 more Admin privilege escalation and arbitrary code execution via malicious *.etherpad imports 9.9 Critical