cve.bz

CWE-116: Improper Encoding or Escaping of Output, page 8

Filter

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

What the weakness is: CWE-116 at MITRE

Ask an AI about CWE-116

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-116: Improper Encoding or Escaping of Output and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/116.html and https://cve.bz/cve/cwe/116?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2024-5585EPSS 29%

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to in…

  2. 9.8CVE-2024-4177EPSS 0.4%

    A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-2 that are runnin…

  3. 3.3CVE-2024-34715EPSS 0.3%

    Fides is an open-source privacy engineering platform. The Fides webserver requires a connection to a hosted PostgreSQL database for persistent storage of application data. If the password used by the webserver for this database connection …

  4. 6.8CVE-2024-4420EPSS 0.2%

    There exists a Denial of service vulnerability in Tink-cc in versions prior to 2.1.3.  * An adversary can crash binaries using the crypto::tink::JsonKeysetReader in tink-cc by providing an input that is not an encoded JSON object, but st…

  5. 5.4CVE-2024-34355EPSS 0.6%

    TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript e…

  6. 4.7CVE-2024-29894EPSS 0.9%

    Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 contain a residual cross-site scripting vulnerability caused by an incomplete fix for CVE-2023-50250. `raise_message_javascript` fro…

  7. 7.5CVE-2024-34510EPSS 0.7%

    Gradio before 4.20 allows credential leakage on Windows.

  8. 5.3CVE-2023-28952EPSS 0.4%

    IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to injection attacks in application logging by not sanitizing user provided data. IBM X-Force ID: 251463.

  9. 9.4CVE-2024-1874EPSS 33%

    In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the …

  10. 9.8CVE-2024-31866EPSS 1.6%

    Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELIN_INTP_CLASSPATH_OVERRIDES. This issue affects Apache Zeppelin: fr…

  11. 4.9CVE-2024-22356EPSS 0.5%

    IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.9.0 and IBM Integration Bus for z/OS 10.1 through 10.1.0.2store potentially sensitive information in log or trace files that could be read by a privileged user. …

  12. 6.1CVE-2024-28245EPSS 0.4%

    KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\includegraphics` that runs arbitrary JavaScript, or generate invalid HTML. U…

  13. 6.5CVE-2024-29156EPSS 0.7%

    In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account informat…

  14. 5.3CVE-2024-27938EPSS 0.7%

    Postal is an open source SMTP server. Postal versions less than 3.0.0 are vulnerable to SMTP Smuggling attacks which may allow incoming e-mails to be spoofed. This, in conjunction with a cooperative outgoing SMTP service, would allow for a…

  15. 6.5CVE-2022-22399EPSS 0.4%

    IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-s…

  16. 4.3CVE-2024-21499EPSS 0.5%

    All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due to redirecting to the injected protocol.Exploiting this vulnerability could lead to bypass of secur…

  17. 5.5CVE-2024-0690EPSS 0.3%

    An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the tas…

  18. 7.5CVE-2024-1064EPSS 0.8%

    A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition via a modified host header

  19. 9.8CVE-2023-47143EPSS 0.8%

    IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks again…

  20. 9.8CVE-2024-0987EPSS 0.9%

    A vulnerability classified as critical has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected is an unknown function of the file /runtime/log. The manipulation leads to improper output neutralization for logs. The exploit …

  21. 4.3CVE-2024-22229EPSS 0.3%

    Dell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed by an authenticated attacker. An attacker could exploit this vulnerability to forge log entries, create false alarms, and inject malicious conte…

  22. 7.8CVE-2023-28738EPSS 0.2%

    Improper input validation for some Intel NUC BIOS firmware before version JY0070 may allow a privileged user to potentially enable escalation of privilege via local access.

  23. 5.3CVE-2023-7234EPSS 0.4%

    OPCUAServerToolkit will write a log message once an OPC UA client has successfully connected containing the client's self-defined description field.

  24. 6.1CVE-2024-0233EPSS 0.4%

    The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not properly sanitise and escape a parameter before outputting it back in pages, leading to a Reflected Cross-Site Scripting which could be used against hi…

  25. 4.8CVE-2023-6005EPSS 0.4%

    The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even wh…

  26. 7.5CVE-2023-52102EPSS 0.3%

    Vulnerability of parameters being not verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality.

  27. 7.5CVE-2023-52098EPSS 0.4%

    Denial of Service (DoS) vulnerability in the DMS module. Successful exploitation of this vulnerability will affect availability.

  28. 6.1CVE-2024-22199EPSS 0.5%

    This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template …

  29. 5.3CVE-2023-42183EPSS 0.6%

    lockss-daemon (aka Classic LOCKSS Daemon) before 1.77.3 performs post-Unicode normalization, which may allow bypass of intended access restrictions, such as when U+1FEF is converted to a backtick.

  30. 8.2CVE-2023-45539EPSS 1.5%

    HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to …

  31. 7.8CVE-2023-26279EPSS 0.2%

    IBM QRadar WinCollect Agent 10.0 through 10.1.7 could allow a local user to perform unauthorized actions due to improper encoding. IBM X-Force ID: 248160.

  32. 9.8CVE-2023-38316EPSS 1.1%

    An issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape callback is enabled, attackers can execute arbitrary OS commands by inserting them into the URL portion of HTTP GET requests. Affected OpenND…

  33. 9.8CVE-2023-48655EPSS 0.9%

    An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters.

  34. 6.5CVE-2023-40453EPSS 0.9%

    Docker Machine through 0.16.2 allows an attacker, who has control of a worker node, to provide crafted version data, which might potentially trick an administrator into performing an unsafe action (via escape sequence injection), or might …

  35. 4.9CVE-2023-5968EPSS 0.5%

    Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body.

  36. 6.1CVE-2023-4393EPSS 0.4%

    HTML and SMTP injections on the registration page of LiquidFiles versions 3.7.13 and below, allow an attacker to perform more advanced phishing attacks against an organization.

  37. 8.0CVE-2023-45135EPSS 1.9%

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In `org.xwiki.platform:xwiki-platform-web` versions 7.2-milestone-2 until 14.10.12 and `org.xwiki.platform:xwiki-platform-web-template…

  38. 9.8CVE-2023-46301EPSS 1.3%

    iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to upload.

  39. 9.8CVE-2023-46300EPSS 1.3%

    iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to tmux integration.

  40. 6.5CVE-2023-5654EPSS 0.6%

    The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requ…

  41. 7.8CVE-2023-43620EPSS 0.4%

    An issue was discovered in Croc through 9.6.5. A sender may place ANSI or CSI escape sequences in a filename to attack the terminal device of a receiver.

  42. 5.3CVE-2023-41889EPSS 0.7%

    SHIRASAGI is a Content Management System. Prior to version 1.18.0, SHIRASAGI is vulnerable to a Post-Unicode normalization issue. This happens when a logical validation or a security check is performed before a Unicode normalization. The U…

  43. 5.4CVE-2023-37875EPSS 0.3%

    Improper encoding or escaping of output in Wing FTP Server (User Web Client) allows Cross-Site Scripting (XSS).This issue affects Wing FTP Server: <= 7.2.0.

  44. 8.6CVE-2023-4571EPSS 0.3%

    In Splunk IT Service Intelligence (ITSI) versions below below 4.13.3, 4.15.3, or 4.17.1, a malicious actor can inject American National Standards Institute (ANSI) escape codes into Splunk ITSI log files that, when a vulnerable terminal app…

  45. 6.1CVE-2023-3481EPSS 0.2%

    Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. We recommend upgrading to version 0.0.20 of the extension.

  46. 7.5CVE-2023-39390EPSS 0.4%

    Vulnerability of input parameter verification in certain APIs in the window management module. Successful exploitation of this vulnerability may cause the device to restart.

  47. 7.5CVE-2023-39386EPSS 0.4%

    Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause newly installed apps to fail to restart.

  48. 7.5CVE-2023-39382EPSS 0.4%

    Input verification vulnerability in the audio module. Successful exploitation of this vulnerability may cause virtual machines (VMs) to restart.

  49. 7.5CVE-2023-39381EPSS 0.4%

    Input verification vulnerability in the storage module. Successful exploitation of this vulnerability may cause the device to restart.

  50. 7.5CVE-2022-36392EPSS 0.7%

    Improper input validation in some firmware for Intel(R) AMT and Intel(R) Standard Manageability before versions 11.8.94, 11.12.94, 11.22.94, 12.0.93, 14.1.70, 15.0.45, and 16.1.27 in Intel (R) CSME may allow an unauthenticated user to pote…