CWE-838: Inappropriate Encoding for Output Context
The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.
A kind of CWE-116 Improper Encoding or Escaping of Output.
From the CWE List. © The MITRE Corporation.
Newest
- mariadb-corporation mariadb-connector-j MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing 5.9 Medium
- mongodb c# driver, mongodb.libmongocrypt nuget package +1 more Plaintext exposure of encrypted fields via ANSI code-page corruption of database name 6.9 Medium
- zammad Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute 6.3 Medium
- org.mariadb r2dbc-mariadb, mariadb-corporation mariadb-connector-r2dbc +1 more MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb 5.9 Medium
- mariadb-corporation mariadb-connector-j MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client 5.9 Medium
- joshnuss xml builder Round-trip Corruption via Improper Entity Escaping in xml_builder 2.1 Low
- fossbilling FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal 4.8 Medium
- google chrome Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote... 9.8 Critical
- mozilla firefox, thunderbird +1 more Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have... 7.5 High
- moodle, fedoraproject fedora +1 more moodle: unsanitized HTML in site log for config_log_created 4.3 Medium
- proofpoint enterprise protection HTML injection in email body through email subject 5.3 Medium
- google chrome, debian linux, fedoraproject fedora +2 more Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a... 6.5 Medium
- google chrome Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to 115.0.5790... 4.3 Medium
- solarwinds engineer's toolset, engineer\'s toolset +1 more Unprotected Transport of Credentials (HSTS) Vulnerability 5.3 Medium
- jenkins project pipeline: stage view plugin, jenkins pipeline\ +1 more Jenkins Pipeline: Stage View Plugin allows CSRF protection bypass of any target URL in Jenkins 6.5 Medium
- jenkins project pipeline: input step plugin, jenkins pipeline\ +1 more CSRF protection for any URL can be bypassed in Jenkins Pipeline: Input Step Plugin 8.8 High
- cpanel cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567). 4.1 Medium
- mcafee web gateway (mwg), web gateway, mcafee,llc mcafee web gateway (mwg) +2 more Web Gateway (MWG) - Inappropriate Encoding for output context 4.3 Medium
- percona xtradb cluster An issue was discovered in Percona XtraDB Cluster before 5.7.28-31.42. A bundled script... 8.1 High
- pimcore Pimcore Access Control Issues 9.8 Critical
- openbsd openssh, netapp element software, ontap select deploy +7 more +9 more In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a... 6.8 Medium
- hyper runv util.c in runV 1.0.0 for Docker mishandles a numeric username, which allows attackers to obtain... 7.8 High