CWE-116 · Improper Encoding or Escaping of Output (page 4)
Page 4 of 5 — CVEs classified under CWE-116, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-39381 | High | 7.5 | 2023-08-13 | Input verification vulnerability in the storage module. Successful exploitation of this vulnerability may cause the device to restart. |
CVE-2022-36392 | High | 8.6 | 2023-08-11 | Improper input validation in some firmware for Intel(R) AMT and Intel(R) Standard Manageability before versions 11.8.94, 11.12.94, 11.22.94, 12.0.93, 14.1.70… |
CVE-2023-40014 | Medium | 5.3 | 2023-08-10 | OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using `ERC2771Contex… |
CVE-2023-39527 | High | 8.3 | 2023-08-07 | PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to cross-site scripting through the `isCle… |
CVE-2023-3997 | High | 8.6 | 2023-07-31 | Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk… |
CVE-2022-43713 | High | 7.5 | 2023-07-26 | Interactive Forms (IAF) in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data input because form validation could be bypa… |
CVE-2022-31458 | Medium | 6.1 | 2023-07-25 | RTX TRAP v1.0 was discovered to be vulnerable to host header poisoning. |
CVE-2023-35941 | High | 8.6 | 2023-07-25 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malici… |
CVE-2023-34036 | Medium | 5.3 | 2023-07-17 | Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind… |
CVE-2023-3668 | High | 7.2 | 2023-07-14 | Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21. |
CVE-2023-24480 | Critical | 9.8 | 2023-07-13 | Controller DoS due to stack overflow when decoding a message from the server. See Honeywell Security Notification for recommendations on upgrading and versio… |
CVE-2023-2200 | Medium | 4.1 | 2023-07-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all vers… |
CVE-2023-36921 | High | 7.2 | 2023-07-11 | SAP Solution Manager (Diagnostics agent) - version 7.20, allows an attacker to tamper with headers in a client request. This misleads SAP Diagnostics Agent to… |
CVE-2023-36919 | Medium | 5.3 | 2023-07-11 | In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Referrer-Policy response header is not i… |
CVE-2023-3552 | Medium | 5.4 | 2023-07-08 | Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10. |
CVE-2023-32301 | Low | 3.1 | 2023-06-13 | Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branche… |
CVE-2023-3190 | Medium | 4.6 | 2023-06-10 | Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9. |
CVE-2023-29543 | High | 8.8 | 2023-06-02 | An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerabil… |
CVE-2023-29541 | High | 8.8 | 2023-06-02 | Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands. <br>*This bug… |
CVE-2023-23599 | Medium | 6.5 | 2023-06-02 | When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands… |
CVE-2023-32712 | High | 8.6 | 2023-06-01 | In Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2, an attacker can inject American National Standards Institute (ANSI) escape codes into Splun… |
CVE-2023-1711 | Medium | 4.0 | 2023-05-30 | A vulnerability exists in a FOXMAN-UN and UNEM logging component, it only affects systems that use remote authentication to the network elements. If exploited… |
CVE-2023-31669 | Medium | 5.5 | 2023-05-23 | WebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote ("). |
CVE-2023-32071 | Critical | 9.0 | 2023-05-09 | XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute… |
CVE-2023-30844 | Low | 3.0 | 2023-05-08 | Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in `mutagen` and prior to v… |
CVE-2022-30351 | High | 7.5 | 2023-03-30 | PDFZorro PDFZorro Online r20220428 using TCPDF 6.2.5, despite having workflows claiming to correctly remove redacted information from a supplied PDF file, does… |
CVE-2023-28733 | High | 7.2 | 2023-03-30 | AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when acce… |
CVE-2022-46387 | Critical | 9.8 | 2023-03-28 | ConEmu through 220807 and Cmder before 1.3.21 report the title of the terminal, including control characters, which allows an attacker to change the title and… |
CVE-2022-42948 | Critical | 9.8 | 2023-03-24 | Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely… |
CVE-2023-28101 | Medium | 5.0 | 2023-03-16 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, i… |
CVE-2023-28487 | Medium | 5.3 | 2023-03-16 | Sudo before 1.9.13 does not escape control characters in sudoreplay output. |
CVE-2023-28486 | Medium | 5.3 | 2023-03-16 | Sudo before 1.9.13 does not escape control characters in log messages. |
CVE-2023-26472 | Critical | 9.9 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by cre… |
CVE-2023-0595 | Medium | 5.3 | 2023-02-24 | A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious packets are sent to… |
CVE-2022-48339 | High | 7.8 | 2023-02-20 | An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file… |
CVE-2022-45102 | Medium | 5.4 | 2023-02-01 | Dell EMC Data Protection Central, versions 19.1 through 19.7, contains a Host Header Injection vulnerability. A remote unauthenticated attacker may potentiall… |
CVE-2015-10040 | Medium | 5.4 | 2023-01-13 | A vulnerability was found in gitlearn. It has been declared as problematic. This vulnerability affects the function getGrade/getOutOf of the file scripts/confi… |
CVE-2022-45143 | High | 7.5 | 2023-01-03 | The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circ… |
CVE-2015-10011 | Medium | 4.6 | 2023-01-02 | A vulnerability classified as problematic has been found in OpenDNS OpenResolve. This affects an unknown part of the file resolverapi/endpoints.py. The manipul… |
CVE-2020-36567 | High | 7.5 | 2022-12-27 | Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines. |
CVE-2022-28284 | High | 8.8 | 2022-12-22 | SVG's <code><use></code> element could have been used to load unexpected content that could have executed script in certain circumstances. While the spec… |
CVE-2022-22744 | High | 8.8 | 2022-12-22 | The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This could have lead to command injection if… |
CVE-2022-43543 | Medium | 5.4 | 2022-12-21 | KDDI +Message App, NTT DOCOMO +Message App, and SoftBank +Message App contain a vulnerability caused by improper handling of Unicode control characters. +Messa… |
CVE-2022-43883 | Medium | 6.5 | 2022-12-19 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to a Log Injection attack by constructing URLs from user-controlled data. This could enabl… |
CVE-2021-38997 | Medium | 5.4 | 2022-12-12 | IBM API Connect V10.0.0.0 through V10.0.5.0, V10.0.1.0 through V10.0.1.7, and V2018.4.1.0 through 2018.4.1.19 is vulnerable to HTTP header injection, caused by… |
CVE-2022-41934 | Critical | 9.9 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on commonly accessible docum… |
CVE-2022-40870 | High | 8.1 | 2022-11-23 | The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attackers to execute arbi… |
CVE-2022-0421 | Medium | 6.1 | 2022-11-21 | The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allo… |
CVE-2022-4011 | Medium | 6.5 | 2022-11-16 | A vulnerability was found in Simple History Plugin. It has been rated as critical. This issue affects some unknown processing of the component Header Handler… |
CVE-2022-34316 | Low | 3.7 | 2022-11-14 | IBM CICS TX 11.1 does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can proce… |
CVE-2022-3941 | Medium | 5.3 | 2022-11-11 | A vulnerability has been found in Activity Log Plugin and classified as critical. This vulnerability affects unknown code of the component HTTP Header Handler… |
CVE-2021-42010 | Critical | 9.8 | 2022-10-24 | Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating… |
CVE-2022-41443 | Critical | 9.8 | 2022-10-03 | phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php. |
CVE-2021-40694 | Medium | 4.9 | 2022-09-29 | Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account. |
CVE-2022-41322 | High | 7.8 | 2022-09-23 | In Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code execution. The user must display attacke… |
CVE-2022-39958 | High | 7.5 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedl… |
CVE-2022-39957 | High | 7.3 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset… |
CVE-2022-39956 | High | 7.3 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character en… |
CVE-2022-36100 | Critical | 9.9 | 2022-09-08 | XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7 in XWiki Platform… |
CVE-2022-36099 | Critical | 9.9 | 2022-09-08 | XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milestone-2 and prior… |
CVE-2021-4041 | High | 7.8 | 2022-08-24 | A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters g… |
CVE-2020-36599 | Critical | 9.8 | 2022-08-18 | lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value. |
CVE-2022-35153 | Critical | 9.8 | 2022-08-18 | FusionPBX 5.0.1 was discovered to contain a command injection vulnerability via /fax/fax_send.php. |
CVE-2022-2619 | Medium | 4.3 | 2022-08-12 | Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious… |
CVE-2022-2241 | Medium | 6.1 | 2022-08-01 | The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to m… |
CVE-2022-36446 | Critical | 9.8 | 2022-07-25 | software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. |
CVE-2022-2099 | Medium | 4.8 | 2022-07-17 | The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles |
CVE-2022-20230 | Medium | 5.5 | 2022-07-13 | In choosePrivateKeyAlias of KeyChain.java, there is a possible access to the user's certificate due to improper input validation. This could lead to local info… |
CVE-2022-34820 | High | 8.4 | 2022-07-12 | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions < V3.3.46), SIMATIC CP 1243-1 (All versions < V3.3.46), SIMATIC CP 1243-7 LTE EU (All… |
CVE-2022-32549 | Medium | 5.3 | 2022-06-22 | Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover trac… |
CVE-2022-23079 | | 2022-06-22 | In motor-admin versions 0.0.1 through 0.2.56 are vulnerable to host header injection in the password reset functionality where malicious actor can send fake pa… | |
CVE-2022-29258 | High | 7.4 | 2022-05-31 | XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Start… |
CVE-2022-29252 | High | 7.4 | 2022-05-25 | XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-milestone-2, XWiki Platform Wiki UI Main Wiki contains a possibl… |
CVE-2022-29251 | High | 7.4 | 2022-05-25 | XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possi… |
CVE-2022-29599 | Critical | 9.8 | 2022-05-23 | In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injecti… |
CVE-2022-28960 | High | 8.8 | 2022-05-19 | A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parameter at /ecrire. |
CVE-2022-30966 | Medium | 5.4 | 2022-05-17 | Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, res… |
CVE-2021-23266 | Medium | 4.3 | 2022-05-16 | An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator. |
CVE-2022-30781 | High | 7.5 | 2022-05-16 | Gitea before 1.16.7 does not escape git fetch remote. |
CVE-2021-39027 | Medium | 5.0 | 2022-05-06 | IBM Guardium Data Encryption (GDE) 4.0.0 and 5.0.0 prepares a structured message for communication with another component, but encoding or escaping of the data… |
CVE-2021-29854 | High | 7.2 | 2022-05-03 | IBM Maximo Asset Management 7.6.1.1 and 7.6.1.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending… |
CVE-2022-0935 | High | 8.8 | 2022-04-07 | Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97. |
CVE-2022-0741 | Medium | 5.8 | 2022-04-01 | Improper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed an attacker to steal environment variables via specially crafte… |
CVE-2022-0450 | Medium | 5.4 | 2022-03-28 | The Menu Image, Icons made easy WordPress plugin before 3.0.6 does not have authorisation and CSRF checks when saving menu settings, and does not validate, san… |
CVE-2022-26174 | Critical | 9.8 | 2022-03-21 | A remote code execution (RCE) vulnerability in Beekeeper Studio v3.2.0 allows attackers to execute arbitrary code via a crafted payload injected into the displ… |
CVE-2021-45848 | High | 7.5 | 2022-03-15 | Denial of service (DoS) vulnerability in Nicotine+ 3.0.3 and later allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download… |
CVE-2022-22734 | Medium | 6.1 | 2022-03-14 | The Simple Quotation WordPress plugin through 1.3.2 does not have CSRF check when creating or editing a quote and does not sanitise and escape Quotes. As a res… |
CVE-2022-22151 | High | 8.1 | 2022-03-11 | CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs: CENTUM CS 3000 versions from R3.08.10 t… |
CVE-2020-27958 | Medium | 4.3 | 2022-02-26 | The Job Composer app in Ohio Supercomputer Center Open OnDemand before 1.7.19 and 1.8.x before 1.8.18 allows remote authenticated users to provide crafted inpu… |
CVE-2022-25235 | Critical | 9.8 | 2022-02-16 | xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain con… |
CVE-2021-43106 | Medium | 6.1 | 2022-02-14 | A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online (TWO) 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP h… |
CVE-2022-23620 | Medium | 6.8 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionH… |
CVE-2022-24682 | Medium | 6.1 | 2022-02-09 | An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in Dec… |
CVE-2022-0220 | Medium | 6.1 | 2022-02-01 | The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, respond… |
CVE-2022-23603 | Critical | 9.9 | 2022-02-01 | iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music. In code before commit 24f43aa user input is not properly sanitiz… |
CVE-2022-22992 | High | 7.8 | 2022-01-28 | A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary sy… |
CVE-2021-45226 | Medium | 6.5 | 2022-01-24 | An issue was discovered in COINS Construction Cloud 11.12. Due to improper validation of user-controlled HTTP headers, attackers can cause it to send password-… |
CVE-2022-0210 | Medium | 4.8 | 2022-01-18 | The Random Banner WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the category parameter found in the ~/include/… |
CVE-2022-0124 | Medium | 4.3 | 2022-01-18 | An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. Gitlab's Slack integration is… |
CVE-2021-29872 | Medium | 5.4 | 2022-01-18 | IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of… |