CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) (page 48)
Page 48 of 55 — CVEs classified under CWE-74, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-26261 | Critical | 9.8 | 2023-03-08 | In UBIKA WAAP Gateway/Cloud through 6.10, a blind XPath injection leads to an authentication bypass by stealing the session of another connected user. The fixe… |
CVE-2023-27479 | Critical | 9.9 | 2023-03-07 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with view rights can exe… |
CVE-2023-27635 | High | 7.8 | 2023-03-05 | debmany in debian-goodies 0.88.1 allows attackers to execute arbitrary shell commands (because of an eval call) via a crafted .deb file. (The path is shown to… |
CVE-2022-42797 | High | 7.8 | 2023-02-27 | An injection issue was addressed with improved input validation. This issue is fixed in Xcode 14.1. An app may be able to gain root privileges. |
CVE-2023-1061 | Medium | 6.3 | 2023-02-27 | A vulnerability, which was classified as critical, has been found in SourceCodester Doctors Appointment System 1.0. This issue affects some unknown processing… |
CVE-2023-1059 | Medium | 6.3 | 2023-02-27 | A vulnerability classified as critical was found in SourceCodester Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/d… |
CVE-2023-20858 | High | 7.2 | 2023-02-22 | VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with… |
CVE-2023-25613 | Critical | 9.8 | 2023-02-20 | An LDAP Injection vulnerability exists in the LdapIdentityBackend of Apache Kerby before 2.0.3. |
CVE-2022-36775 | Medium | 6.5 | 2023-02-17 | IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper validation of input b… |
CVE-2022-42472 | Medium | 4.2 | 2023-02-16 | A improper neutralization of crlf sequences in http headers ('http response splitting') in Fortinet FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8… |
CVE-2023-23936 | Medium | 6.5 | 2023-02-16 | Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from… |
CVE-2023-25141 | High | 7.5 | 2023-02-14 | Apache Sling JCR Base < 3.1.12 has a critical injection vulnerability when running on old JDK versions (JDK 1.8.191 or earlier) through utility functions in Re… |
CVE-2023-25719 | High | 8.8 | 2023-02-13 | ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.ex… |
CVE-2022-43756 | Medium | 5.9 | 2023-02-07 | A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SUSE Rancher allows remote attackers to c… |
CVE-2023-0493 | Medium | 5.3 | 2023-01-26 | Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5. |
CVE-2023-0476 | Medium | 6.5 | 2023-01-26 | A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker c… |
CVE-2022-47052 | Medium | 6.1 | 2023-01-26 | The web interface of the 'Nighthawk R6220 AC1200 Smart Wi-Fi Router' is vulnerable to a CRLF Injection attack that can be leveraged to perform Reflected XSS an… |
CVE-2023-24040 | High | 7.1 | 2023-01-21 | dtprintinfo in Common Desktop Environment 1.6 has a bug in the parser of lpstat (an invoked external command) during listing of the names of available printers… |
CVE-2022-3918 | High | 8.8 | 2023-01-20 | A program using FoundationNetworking in swift-corelibs-foundation is potentially vulnerable to CRLF ( ) injection in URLRequest headers. In this vulnerability… |
CVE-2021-37499 | Medium | 6.5 | 2023-01-20 | CRLF vulnerability in Reprise License Manager (RLM) web interface through 14.2BL4 in the password parameter in View License Result function, that allows remote… |
CVE-2023-20057 | Unrated | | 2023-01-20 | A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attack… |
CVE-2017-20174 | Medium | 5.6 | 2023-01-19 | A vulnerability was found in bastianallgeier Kirby Webmentions Plugin and classified as problematic. Affected by this issue is some unknown functionality. The… |
CVE-2023-0040 | High | 7.5 | 2023-01-18 | Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the resul… |
CVE-2023-23749 | High | 7.5 | 2023-01-17 | The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to LDAP Injection since is not properly sanitizing th… |
CVE-2015-10062 | Medium | 5.5 | 2023-01-17 | A vulnerability, which was classified as problematic, was found in galaxy-data-resource up to 14.10.0. This affects an unknown part of the component Command Li… |
CVE-2022-43720 | Medium | 5.4 | 2023-01-16 | An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast messa… |
CVE-2023-0302 | High | 7.8 | 2023-01-15 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.2. |
CVE-2015-10040 | Medium | 5.4 | 2023-01-13 | A vulnerability was found in gitlearn. It has been declared as problematic. This vulnerability affects the function getGrade/getOutOf of the file scripts/confi… |
CVE-2022-42268 | High | 7.8 | 2023-01-13 | Omniverse Kit contains a vulnerability in the reference applications Create, Audio2Face, Isaac Sim, View, Code, and Machinima. These applications allow execut… |
CVE-2015-10027 | Medium | 5.5 | 2023-01-07 | A vulnerability, which was classified as problematic, has been found in hydrian TTRSS-Auth-LDAP. Affected by this issue is some unknown functionality of the co… |
CVE-2022-37933 | High | 7.3 | 2023-01-05 | A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. The vulnerability could be exploited to allow loca… |
CVE-2022-46180 | Medium | 5.0 | 2023-01-04 | Discourse Mermaid (discourse-mermaid-theme-component) allows users of Discourse, open-source forum software, to create graphs using the Mermaid syntax. Users o… |
CVE-2022-42471 | Medium | 5.4 | 2023-01-03 | An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In FortiWeb version 7.0.0 through 7.0.2, Forti… |
CVE-2016-15007 | Medium | 5.5 | 2023-01-02 | A vulnerability was found in Centralized-Salesforce-Dev-Framework. It has been declared as problematic. Affected by this vulnerability is the function SObjectS… |
CVE-2017-20161 | Medium | 4.6 | 2023-01-02 | A vulnerability classified as problematic has been found in rofl0r MacGeiger. Affected is the function dump_wlan_at of the file macgeiger.c of the component ES… |
CVE-2022-4864 | Medium | 5.4 | 2022-12-30 | Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. |
CVE-2022-4768 | Medium | 6.3 | 2022-12-27 | A vulnerability was found in Dropbox merou. It has been classified as critical. Affected is the function add_public_key of the file grouper/public_key.py of th… |
CVE-2022-46873 | High | 8.8 | 2022-12-22 | Because Firefox did not implement the <code>unsafe-hashes</code> CSP directive, an attacker who was able to inject markup into a page otherwise protected by a… |
CVE-2022-40958 | Medium | 6.5 | 2022-12-22 | By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies fro… |
CVE-2022-40145 | Critical | 9.8 | 2022-12-21 | This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modul… |
CVE-2020-36618 | Medium | 6.3 | 2022-12-19 | A vulnerability classified as critical has been found in Furqan node-whois. Affected is an unknown function of the file index.coffee. The manipulation leads to… |
CVE-2022-42544 | High | 7.8 | 2022-12-16 | In getView of AddAppNetworksFragment.java, there is a possible way to mislead the user about network add requests due to improper input validation. This could… |
CVE-2021-4245 | Medium | 5.5 | 2022-12-15 | A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipulation leads to imp… |
CVE-2022-46265 | Medium | 5.4 | 2022-12-13 | A vulnerability has been identified in Polarion ALM (All versions < V2304.0). The affected application contains a Host header injection vulnerability that coul… |
CVE-2022-4170 | Critical | 9.8 | 2022-12-09 | The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user'… |
CVE-2022-4364 | High | 7.3 | 2022-12-08 | A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. Affected by this issue is some unknown functionality of the file palette.php of the componen… |
CVE-2022-45910 | Medium | 5.3 | 2022-12-07 | Improper neutralization of special elements used in an LDAP query ('LDAP Injection') vulnerability in ActiveDirectory and Sharepoint ActiveDirectory authority… |
CVE-2022-3643 | Medium | 6.5 | 2022-12-07 | Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network… |
CVE-2022-46169 | Critical | 9.8 | 2022-12-05 | Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a… |
CVE-2022-35507 | High | 7.1 | 2022-12-04 | A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker t… |
CVE-2022-46162 | High | 8.8 | 2022-11-30 | discourse-bbcode is the official BBCode plugin for Discourse. Prior to commit 91478f5, CSS injection can occur when rendering content generated with the discou… |
CVE-2022-4188 | Medium | 4.3 | 2022-11-30 | Insufficient validation of untrusted input in CORS in Google Chrome on Android prior to 108.0.5359.71 allowed a remote attacker to bypass same origin policy vi… |
CVE-2022-41934 | Critical | 9.9 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on commonly accessible docum… |
CVE-2022-33012 | High | 8.8 | 2022-11-22 | Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack. |
CVE-2022-4064 | Low | 3.7 | 2022-11-19 | A vulnerability was found in Dalli up to 3.2.2. It has been classified as problematic. Affected is the function self.meta_set of the file lib/dalli/protocol/me… |
CVE-2021-33621 | High | 8.8 | 2022-11-18 | The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untru… |
CVE-2022-41878 | High | 7.2 | 2022-11-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that ar… |
CVE-2022-43562 | Low | 3.0 | 2022-11-04 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, Splunk Enterprise fails to properly validate and escape the Host header, which could let a remote… |
CVE-2022-20772 | Medium | 4.7 | 2022-11-04 | A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HT… |
CVE-2022-39382 | Critical | 9.8 | 2022-11-03 | Keystone is a headless CMS for Node.js — built with GraphQL and React.`@keystone-6/core@3.0.0 || 3.0.1` users that use `NODE_ENV` to trigger security-sensitive… |
CVE-2022-31777 | Medium | 5.4 | 2022-11-01 | A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the… |
CVE-2022-39016 | High | 8.2 | 2022-10-31 | Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload. |
CVE-2021-38395 | Critical | 9.1 | 2022-10-28 | Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attac… |
CVE-2022-42468 | Critical | 9.8 | 2022-10-26 | Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe provide… |
CVE-2022-3607 | Medium | 6.0 | 2022-10-19 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3. |
CVE-2022-2992 | Critical | 9.9 | 2022-10-17 | A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remot… |
CVE-2021-36913 | High | 7.5 | 2022-10-11 | Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at WordPress allows attackers to… |
CVE-2022-40257 | Medium | 5.4 | 2022-10-10 | An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with… |
CVE-2022-40248 | Medium | 5.4 | 2022-10-10 | An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Produ… |
CVE-2022-39265 | High | 7.2 | 2022-10-06 | MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connecti… |
CVE-2020-27602 | Critical | 9.8 | 2022-09-29 | BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken. |
CVE-2022-3215 | High | 7.5 | 2022-09-28 | NIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack. This occurs when a HTTP/1.1 server accepts use… |
CVE-2021-41437 | Medium | 6.5 | 2022-09-26 | An HTTP response splitting attack in web application in ASUS RT-AX88U before v3.0.0.4.388.20558 allows an attacker to craft a specific URL that if an authentic… |
CVE-2022-35914 | Critical | 9.8 | 2022-09-19 | /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. |
CVE-2022-39217 | Medium | 5.8 | 2022-09-17 | some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affec… |
CVE-2022-38796 | Medium | 6.1 | 2022-09-14 | A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. This can be exploited by abusing password reset em… |
CVE-2022-34165 | Medium | 5.4 | 2022-09-09 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.9 are vulnerable to HTTP header in… |
CVE-2022-36084 | Critical | 9.9 | 2022-09-08 | cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versi… |
CVE-2022-37108 | High | 8.7 | 2022-09-07 | An injection vulnerability in the syslog-ng configuration wizard in Securonix Snypr 6.4 allows an application user with the "Manage Ingesters" permission to ex… |
CVE-2022-37242 | Critical | 9.8 | 2022-08-25 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2, is vulnerable to HTTP Response splitting via the data parameter. |
CVE-2022-37240 | Critical | 9.8 | 2022-08-25 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to HTTP Response splitting via the format parameter. |
CVE-2022-34773 | Medium | 4.9 | 2022-08-22 | Tabit - HTTP Method manipulation. https://bridge.tabit.cloud/configuration/addresses-query - can be POST-ed to add addresses to the DB. This is an example of O… |
CVE-2022-32453 | Medium | 6.5 | 2022-08-18 | HTTP header injection vulnerability in Cybozu Office 10.0.0 to 10.8.5 may allow a remote attacker to obtain and/or alter the data of the product via unspecifie… |
CVE-2022-38357 | High | 8.8 | 2022-08-15 | Improper neutralization of special elements leaves the Eyes of Network Web application vulnerable to an iFrame injection attack, via the url parameter of /modu… |
CVE-2022-38191 | Medium | 6.1 | 2022-08-15 | There is an HTML injection issue in Esri Portal for ArcGIS versions 10.9.0 and below which may allow a remote, authenticated attacker to inject HTML into some… |
CVE-2022-35954 | Medium | 5.0 | 2022-08-15 | The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The `core.exportVariable` function uses a well known delimiter that atta… |
CVE-2022-35948 | Medium | 5.3 | 2022-08-15 | undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized inp… |
CVE-2022-36323 | Critical | 9.1 | 2022-08-10 | Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or s… |
CVE-2022-31665 | High | 7.2 | 2022-08-05 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with administrator and n… |
CVE-2022-31658 | High | 7.2 | 2022-08-05 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with administrator and n… |
CVE-2022-35735 | High | 7.2 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, an authenticated attacker with Resource… |
CVE-2022-31181 | Critical | 9.8 | 2022-08-01 | PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which ca… |
CVE-2022-31180 | Critical | 9.8 | 2022-08-01 | Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output… |
CVE-2022-31179 | High | 8.1 | 2022-08-01 | Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. This impacts users tha… |
CVE-2022-36302 | High | 8.8 | 2022-08-01 | File path manipulation vulnerability in BF-OS version 3.00 up to and including 3.83 allows an attacker to modify the file path to access different resources, w… |
CVE-2021-40336 | Medium | 5.0 | 2022-07-25 | A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitti… |
CVE-2016-15004 | High | 7.3 | 2022-07-23 | A vulnerability was found in InfiniteWP Client Plugin 1.5.1.3/1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2022-22360 | High | 8.8 | 2022-07-19 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to conduct an LDAP injection. By using a sp… |
CVE-2021-39028 | Medium | 5.4 | 2022-07-14 | IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTTP header injection, caused by improper validation… |
CVE-2022-31593 | High | 8.8 | 2022-07-12 | SAP Business One client - version 10.0 allows an attacker with low privileges, to inject code that can be executed by the application. An attacker could thereb… |