CWE-116 · Improper Encoding or Escaping of Output (page 6)
Page 6 of 6 — CVEs classified under CWE-116, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-9862 | High | 7.8 | 2020-10-16 | A command injection issue existed in Web Inspector. This issue was addressed with improved escaping. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4… |
CVE-2019-4326 | High | 7.5 | 2020-10-06 | "HCL AppScan Enterprise security rules update administration section of the web application console is missing HTTP Strict-Transport-Security Header." |
CVE-2020-24592 | Medium | 5.3 | 2020-09-25 | Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to view system information due to insufficient output san… |
CVE-2020-6313 | Medium | 6.5 | 2020-09-09 | SAP NetWeaver Application Server JAVA(XML Forms) versions 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user controlled inputs, which allows an authentic… |
CVE-2020-24972 | High | 8.8 | 2020-08-29 | The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported… |
CVE-2020-16281 | High | 7.8 | 2020-08-20 | The Kommbox component in Rangee GmbH RangeeOS 8.0.4 could allow a local authenticated attacker to escape from the restricted environment and execute arbitrary… |
CVE-2020-7694 | Low | 3.7 | 2020-07-27 | This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP req… |
CVE-2020-6261 | Medium | 5.3 | 2020-07-01 | SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete XML Validation. The r… |
CVE-2017-18892 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized. |
CVE-2020-5304 | High | 7.5 | 2020-06-08 | The dashboard in WhiteSource Application Vulnerability Management (AVM) before version 20.4.1 allows Log Injection via a %0A%0D substring in the idp parameter… |
CVE-2020-13625 | High | 7.5 | 2020-06-08 | PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type b… |
CVE-2020-6227 | High | 7.5 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (CMS / Auditing issues), version 4.2, allows attacker to send specially crafted GIOP packets to several ser… |
CVE-2020-4282 | Medium | 4.3 | 2020-04-08 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could allow an authenticated user to perform unauthorized actions by bypassi… |
CVE-2018-20586 | Medium | 5.3 | 2020-03-12 | bitcoind and Bitcoin-Qt prior to 0.17.1 allow injection of arbitrary data into the debug log via an RPC call. |
CVE-2020-10235 | High | 8.8 | 2020-03-09 | An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database… |
CVE-2013-2011 | High | 8.8 | 2019-12-26 | WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code. This issu… |
CVE-2019-19714 | Medium | 5.3 | 2019-12-17 | Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the… |
CVE-2019-11325 | Critical | 9.8 | 2019-11-21 | An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted o… |
CVE-2019-12675 | High | 8.8 | 2019-10-02 | Multiple vulnerabilities in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape… |
CVE-2019-12674 | High | 8.2 | 2019-10-02 | Multiple vulnerabilities in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape… |
CVE-2019-9853 | High | 7.8 | 2019-09-27 | LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically execution of macros are bloc… |
CVE-2019-10074 | Critical | 9.8 | 2019-09-11 | An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the ca… |
CVE-2019-11547 | Medium | 6.1 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has Improper Encoding o… |
CVE-2019-12463 | High | 8.8 | 2019-09-09 | An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options (includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.p… |
CVE-2019-15944 | Medium | 5.3 | 2019-09-05 | In Counter-Strike: Global Offensive before 8/29/2019, community game servers can display unsafe HTML in a disconnection message. |
CVE-2019-1968 | High | 7.5 | 2019-08-30 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an NX-API system process to unexpectedly… |
CVE-2019-9852 | High | 7.8 | 2019-08-15 | LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc… |
CVE-2019-10362 | Medium | 5.4 | 2019-07-31 | Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, all… |
CVE-2019-11717 | Medium | 5.3 | 2019-07-23 | A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible… |
CVE-2019-3571 | Medium | 5.3 | 2019-07-16 | An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed wi… |
CVE-2019-11268 | Medium | 4.3 | 2019-07-11 | Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for on… |
CVE-2018-16386 | High | 7.5 | 2019-07-05 | An issue was discovered in SWIFT Alliance Web Platform 7.1.23. A log injection (and an arbitrary log filename) can be achieved via the PATH_INFO to swp/login/E… |
CVE-2018-18838 | High | 7.5 | 2019-06-18 | An issue was discovered in Netdata 1.10.0. Log Injection (or Log Forgery) exists via a %0a sequence in the url parameter to api/v1/registry. |
CVE-2019-0971 | Medium | 6.5 | 2019-05-16 | An information disclosure vulnerability exists when Azure DevOps Server and Microsoft Team Foundation Server do not properly sanitize a specially crafted authe… |
CVE-2019-0956 | Medium | 6.5 | 2019-05-16 | An information disclosure vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share… |
CVE-2019-10249 | High | 8.1 | 2019-05-06 | All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised. |
CVE-2019-0857 | Medium | 6.5 | 2019-04-09 | A spoofing vulnerability that could allow a security feature bypass exists in when Azure DevOps Server does not properly sanitize user provided input, aka 'Azu… |
CVE-2019-6109 | Medium | 6.8 | 2019-01-31 | An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can emplo… |
CVE-2018-8920 | High | 7.2 | 2018-12-24 | Improper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to inject arbi… |
CVE-2018-8609 | High | 8.8 | 2018-11-14 | A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) version 8 when the server fails to properly sanitize web requests to an af… |
CVE-2018-15494 | Critical | 9.8 | 2018-08-18 | In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid. |
CVE-2018-9246 | Critical | 9.8 | 2018-06-08 | The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as par… |
CVE-2009-4267 | Medium | 6.5 | 2018-02-19 | The console in Apache jUDDI 3.0.0 does not properly escape line feeds, which allows remote authenticated users to spoof log entries via the numRows parameter. |
CVE-2018-2389 | Medium | 5.7 | 2018-02-14 | Under certain conditions a malicious user can inject log files of SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, hiding important informa… |
CVE-2018-1048 | High | 7.5 | 2018-01-24 | It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / a… |
CVE-2017-12340 | Medium | 4.2 | 2017-11-30 | A vulnerability in Cisco NX-OS System Software running on Cisco MDS Multilayer Director Switches, Cisco Nexus 7000 Series Switches, and Cisco Nexus 7700 Series… |
CVE-2017-12064 | High | 7.5 | 2017-08-01 | The csv_log_html function in library/edihistory/edih_csv_inc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restrictions via a craft… |
CVE-2017-8303 | Critical | 9.8 | 2017-05-05 | An issue was discovered on Accellion FTA devices before FTA_9_12_180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in the method p… |
CVE-2014-9938 | High | 8.8 | 2017-03-20 | contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a malicious repository to cause code executio… |
CVE-2016-2568 | High | 7.8 | 2017-02-13 | pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the term… |
CVE-2016-3063 | High | 7.5 | 2017-02-07 | Multiple functions in NetApp OnCommand System Manager before 8.3.2 do not properly escape special characters, which allows remote authenticated users to execut… |
CVE-2013-4547 | | 2013-11-23 | nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI. |