cve.bz

CWE-707: Improper Neutralization, page 2

Filter

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being used when received from an upstream component, or before being sent to a downstream component.

What the weakness is: CWE-707 at MITRE. All weaknesses

Related attack patterns (CAPEC): 16
  • CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters Likelihood: Medium · Severity: Medium
  • CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
  • CAPEC-43 Exploiting Multiple Input Interpretation Layers Likelihood: Medium · Severity: High
  • CAPEC-52 Embedding NULL Bytes Likelihood: High · Severity: High
  • CAPEC-53 Postfix, Null Terminate, and Backslash Likelihood: High · Severity: High
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-83 XPath Injection Likelihood: High · Severity: High
  • CAPEC-84 XQuery Injection Likelihood: High · Severity: Very High
  • CAPEC-250 XML Injection Likelihood: High
  • CAPEC-276 Inter-component Protocol Manipulation
  • CAPEC-277 Data Interchange Protocol Manipulation
  • CAPEC-278 Web Services Protocol Manipulation
  • CAPEC-279 SOAP Manipulation Likelihood: Medium · Severity: High
  • CAPEC-468 Generic Cross-Browser Cross-Domain Theft Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-707, as MITRE names them. Credits.

Ask an AI about CWE-707

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-707: Improper Neutralization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/707.html and https://cve.bz/cve/cwe/707?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.9CVE-2024-10845EPSS 0.9%

    A vulnerability has been found in 1000 Projects Bookstore Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file book_detail.php. The manipulation of the argument id leads to sql injection. Th…

  2. 6.9CVE-2024-10844EPSS 0.9%

    A vulnerability, which was classified as critical, was found in 1000 Projects Bookstore Management System 1.0. This affects an unknown part of the file search.php. The manipulation of the argument s leads to sql injection. It is possible t…

  3. 5.1CVE-2024-10842EPSS 0.4%

    A vulnerability, which was classified as problematic, has been found in romadebrian WEB-Sekolah 1.0. Affected by this issue is some unknown functionality of the file /Admin/Proses_Edit_Akun.php of the component Backend. The manipulation of…

  4. 5.3CVE-2024-10841EPSS 0.4%

    A vulnerability classified as critical was found in romadebrian WEB-Sekolah 1.0. Affected by this vulnerability is an unknown functionality of the file /Proses_Kirim.php of the component Mail Handler. The manipulation of the argument Name …

  5. 5.1CVE-2024-10840EPSS 0.4%

    A vulnerability classified as problematic has been found in romadebrian WEB-Sekolah 1.0. Affected is an unknown function of the file /Admin/akun_edit.php of the component Backend. The manipulation of the argument kode leads to cross site s…

  6. 5.3CVE-2024-10810EPSS 0.5%

    A vulnerability was found in code-projects E-Health Care System 1.0. It has been classified as critical. Affected is an unknown function of the file Doctor/app_request.php. The manipulation of the argument app_id leads to sql injection. It…

  7. 5.3CVE-2024-10809EPSS 0.5%

    A vulnerability was found in code-projects E-Health Care System 1.0 and classified as critical. This issue affects some unknown processing of the file /Doctor/chat.php. The manipulation of the argument name/message leads to sql injection. …

  8. 5.3CVE-2024-10808EPSS 0.5%

    A vulnerability has been found in code-projects E-Health Care System 1.0 and classified as critical. This vulnerability affects unknown code of the file Admin/req_detail.php. The manipulation of the argument id leads to sql injection. The …

  9. 5.1CVE-2024-10807EPSS 0.4%

    A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been rated as problematic. This issue affects some unknown processing of the file hms/doctor/search.php. The manipulation of the argument searchdata leads to cr…

  10. 5.1CVE-2024-10806EPSS 0.4%

    A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been declared as problematic. This vulnerability affects unknown code of the file betweendates-detailsreports.php. The manipulation of the argument fromdate/tod…

  11. 5.3CVE-2024-10805EPSS 0.5%

    A vulnerability was found in code-projects University Event Management System 1.0. It has been classified as critical. This affects an unknown part of the file doedit.php. The manipulation of the argument id leads to sql injection. It is p…

  12. 6.9CVE-2024-10791EPSS 0.6%

    A vulnerability, which was classified as critical, has been found in Codezips Hospital Appointment System 1.0. This issue affects some unknown processing of the file /doctorAction.php. The manipulation of the argument Name leads to sql inj…

  13. 5.3CVE-2024-10768EPSS 0.4%

    A vulnerability classified as problematic was found in PHPGurukul Online Shopping Portal 2.0. This vulnerability affects unknown code of the file /admin/assets/plugins/DataTables/media/unit_testing/templates/two_tables.php. The manipulatio…

  14. 6.9CVE-2024-10752EPSS 0.6%

    A vulnerability was found in Codezips Pet Shop Management System 1.0. It has been classified as critical. This affects an unknown part of the file /productsadd.php. The manipulation of the argument id/name leads to sql injection. It is pos…

  15. 5.3CVE-2024-10700EPSS 0.6%

    A vulnerability was found in code-projects University Event Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file submit.php. The manipulation of the argument name/email/title/Year/gen…

  16. 7.8CVE-2024-43572KEVEPSS 67%

    Microsoft Management Console Remote Code Execution Vulnerability

  17. 5.3CVE-2024-9324EPSS 0.6%

    A vulnerability was found in Intelbras InControl up to 2.21.57. It has been rated as critical. Affected by this issue is some unknown functionality of the file /v1/operador/ of the component Relatório de Operadores Page. The manipulation o…

  18. 7.8CVE-2024-21864EPSS 0.3%

    Improper neutralization in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.5081 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent network access.

  19. 7.8CVE-2023-46689EPSS 0.2%

    Improper neutralization in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escalation of privilege via local access.

  20. 5.5CVE-2023-45315EPSS 0.2%

    Improper initialization in some Intel(R) Power Gadget software for Windwos all versions may allow an authenticated user to potentially enable denial of service via local access.

  21. 7.8CVE-2023-42773EPSS 0.2%

    Improper neutralization in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via local access.

  22. 6.1CVE-2023-6123EPSS 0.5%

    Improper Neutralization vulnerability affects OpenText ALM Octane version 16.2.100 and above. The vulnerability could result in a remote code execution attack.

  23. 5.4CVE-2022-4730EPSS 0.8%

    A vulnerability was found in Graphite Web. It has been classified as problematic. Affected is an unknown function of the component Absolute Time Range Handler. The manipulation leads to cross site scripting. It is possible to launch the at…

  24. 5.4CVE-2022-4729EPSS 0.8%

    A vulnerability was found in Graphite Web and classified as problematic. This issue affects some unknown processing of the component Template Name Handler. The manipulation leads to cross site scripting. The attack may be initiated remotel…

  25. 5.4CVE-2022-4728EPSS 0.8%

    A vulnerability has been found in Graphite Web and classified as problematic. This vulnerability affects unknown code of the component Cookie Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. Th…

  26. 6.1CVE-2022-4727EPSS 1.0%

    A vulnerability, which was classified as problematic, was found in OpenMRS Appointment Scheduling Module up to 1.16.x. This affects the function getNotes of the file api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentReq…

  27. 9.8CVE-2022-4726EPSS 0.5%

    A vulnerability classified as critical was found in SourceCodester Sanitization Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Admin Login. The manipulation of the argument username/passw…

  28. 6.1CVE-2020-36626EPSS 0.6%

    A vulnerability classified as critical has been found in Modern Tribe Panel Builder Plugin. Affected is the function add_post_content_filtered_to_search_sql of the file ModularContent/SearchFilter.php. The manipulation leads to sql injecti…

  29. 5.4CVE-2022-4642EPSS 0.6%

    A vulnerability was found in tatoeba2. It has been classified as problematic. This affects an unknown part of the component Profile Name Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotel…

  30. 5.4CVE-2022-4640EPSS 0.4%

    A vulnerability has been found in Mingsoft MCMS 5.2.9 and classified as problematic. Affected by this vulnerability is the function save of the component Article Handler. The manipulation leads to cross site scripting. The attack can be la…

  31. 6.1CVE-2022-4638EPSS 0.4%

    A vulnerability classified as problematic was found in collective.contact.widget up to 1.12. This vulnerability affects the function title of the file src/collective/contact/widget/widgets.py. The manipulation leads to cross site scripting…

  32. 6.1CVE-2022-4631EPSS 0.4%

    A vulnerability, which was classified as problematic, was found in WP-Ban. Affected is an unknown function of the file ban-options.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name …

  33. 6.1CVE-2021-4274EPSS 0.5%

    A vulnerability, which was classified as problematic, has been found in sileht bird-lg. This issue affects some unknown processing of the file templates/layout.html. The manipulation of the argument request_args leads to cross site scripti…

  34. 6.1CVE-2021-4273EPSS 0.6%

    A vulnerability classified as problematic was found in studygolang. This vulnerability affects the function Search of the file http/controller/search.go. The manipulation of the argument q leads to cross site scripting. The attack can be i…

  35. 6.1CVE-2021-4272EPSS 0.4%

    A vulnerability classified as problematic has been found in studygolang. This affects an unknown part of the file static/js/topics.js. The manipulation of the argument contentHtml leads to cross site scripting. It is possible to initiate t…

  36. 6.1CVE-2021-4271EPSS 0.4%

    A vulnerability was found in panicsteve w2wiki. It has been rated as problematic. Affected by this issue is the function toHTML of the file index.php of the component Markdown Handler. The manipulation leads to cross site scripting. The at…

  37. 6.1CVE-2021-4270EPSS 0.4%

    A vulnerability was found in Imprint CMS. It has been classified as problematic. Affected is the function SearchForm of the file ImprintCMS/Models/ViewHelpers.cs. The manipulation of the argument query leads to cross site scripting. It is …

  38. 6.1CVE-2021-4269EPSS 0.5%

    A vulnerability has been found in SimpleRisk and classified as problematic. This vulnerability affects the function checkAndSetValidation of the file simplerisk/js/common.js. The manipulation of the argument title leads to cross site scrip…

  39. 6.1CVE-2021-4267EPSS 0.5%

    A vulnerability classified as problematic was found in tad_discuss. Affected by this vulnerability is an unknown functionality. The manipulation of the argument DiscussTitle leads to cross site scripting. The attack can be launched remotel…

  40. 6.1CVE-2021-4266EPSS 0.6%

    A vulnerability classified as problematic has been found in Webdetails cpf up to 9.5.0.0-80. Affected is an unknown function of the file core/src/main/java/pt/webdetails/cpf/packager/DependenciesPackage.java. The manipulation of the argume…

  41. 6.1CVE-2021-4265EPSS 0.5%

    A vulnerability was found in siwapp-ror. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 924d16008…

  42. 6.1CVE-2020-36621EPSS 0.5%

    A vulnerability, which was classified as problematic, has been found in chedabob whatismyudid. Affected by this issue is the function exports.enrollment of the file routes/mobileconfig.js. The manipulation leads to cross site scripting. Th…

  43. 9.8CVE-2021-4262EPSS 0.7%

    A vulnerability classified as critical was found in laravel-jqgrid. Affected by this vulnerability is the function getRows of the file src/Mgallegos/LaravelJqgrid/Repositories/EloquentRepositoryAbstract.php. The manipulation leads to sql i…

  44. 9.8CVE-2021-4261EPSS 0.7%

    A vulnerability classified as critical has been found in pacman-canvas up to 1.0.5. Affected is the function addHighscore of the file data/db-handler.php. The manipulation leads to sql injection. It is possible to launch the attack remotel…

  45. 5.4CVE-2022-3877EPSS 0.7%

    A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected is an unknown function of the component URL Field Handler. The manipulation leads to cross …

  46. 6.1CVE-2021-4257EPSS 0.4%

    A vulnerability was found in ctrlo lenio. It has been declared as problematic. This vulnerability affects unknown code of the file views/task.tt of the component Task Handler. The manipulation of the argument site.org.name/check.name/task.…

  47. 6.1CVE-2021-4256EPSS 0.4%

    A vulnerability was found in ctrlo lenio. It has been classified as problematic. This affects an unknown part of the file views/index.tt. The manipulation of the argument task.name/task.site.org.name leads to cross site scripting. It is po…

  48. 6.1CVE-2021-4255EPSS 0.4%

    A vulnerability was found in ctrlo lenio and classified as problematic. Affected by this issue is some unknown functionality of the file views/contractor.tt. The manipulation of the argument contractor.name leads to cross site scripting. T…

  49. 6.1CVE-2021-4254EPSS 0.4%

    A vulnerability has been found in ctrlo lenio and classified as problematic. Affected by this vulnerability is an unknown functionality of the file views/layouts/main.tt of the component Notice Handler. The manipulation of the argument not…

  50. 6.1CVE-2021-4253EPSS 0.4%

    A vulnerability, which was classified as problematic, was found in ctrlo lenio. Affected is an unknown function in the library lib/Lenio.pm of the component Ticket Handler. The manipulation of the argument site_id leads to cross site scrip…