cve.bz

CWE-707: Improper Neutralization, page 5

Filter

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being used when received from an upstream component, or before being sent to a downstream component.

What the weakness is: CWE-707 at MITRE. All weaknesses

Related attack patterns (CAPEC): 16
  • CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters Likelihood: Medium · Severity: Medium
  • CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
  • CAPEC-43 Exploiting Multiple Input Interpretation Layers Likelihood: Medium · Severity: High
  • CAPEC-52 Embedding NULL Bytes Likelihood: High · Severity: High
  • CAPEC-53 Postfix, Null Terminate, and Backslash Likelihood: High · Severity: High
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-83 XPath Injection Likelihood: High · Severity: High
  • CAPEC-84 XQuery Injection Likelihood: High · Severity: Very High
  • CAPEC-250 XML Injection Likelihood: High
  • CAPEC-276 Inter-component Protocol Manipulation
  • CAPEC-277 Data Interchange Protocol Manipulation
  • CAPEC-278 Web Services Protocol Manipulation
  • CAPEC-279 SOAP Manipulation Likelihood: Medium · Severity: High
  • CAPEC-468 Generic Cross-Browser Cross-Domain Theft Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-707, as MITRE names them. Credits.

Ask an AI about CWE-707

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-707: Improper Neutralization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/707.html and https://cve.bz/cve/cwe/707?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2022-3941EPSS 0.9%

    A vulnerability has been found in Activity Log Plugin and classified as critical. This vulnerability affects unknown code of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to improper output neutr…

  2. 9.8CVE-2022-3878EPSS 0.8%

    A vulnerability classified as critical has been found in Maxon ERP. This affects an unknown part of the file /index.php/purchase_order/browse_data. The manipulation of the argument tb_search leads to sql injection. It is possible to initia…

  3. 9.8CVE-2022-3868EPSS 0.6%

    A vulnerability classified as critical has been found in SourceCodester Sanitization Management System. Affected is an unknown function of the file /php-sms/classes/Master.php?f=save_quote. The manipulation of the argument id leads to sql …

  4. 6.1CVE-2022-3845EPSS 0.7%

    A vulnerability has been found in phpipam and classified as problematic. Affected by this vulnerability is an unknown functionality of the file app/admin/import-export/import-load-data.php of the component Import Preview Handler. The manip…

  5. 6.1CVE-2020-36608EPSS 0.5%

    A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS. Affected by this issue is some unknown functionality of the file admin_organizer.js of the component Error Log Module. The manipulation lea…

  6. 9.8CVE-2022-3827EPSS 1.0%

    A vulnerability was found in centreon. It has been declared as critical. This vulnerability affects unknown code of the file formContactGroup.php of the component Contact Groups Form. The manipulation of the argument cg_id leads to sql inj…

  7. 6.5CVE-2022-3825EPSS 0.7%

    A vulnerability was found in Huaxia ERP 2.3 and classified as critical. Affected by this issue is some unknown functionality of the component User Management. The manipulation of the argument login leads to sql injection. The attack may be…

  8. 6.1CVE-2022-3804EPSS 0.8%

    A vulnerability was found in eolinker apinto-dashboard. It has been classified as problematic. Affected is an unknown function of the file /login. The manipulation of the argument callback leads to cross site scripting. It is possible to l…

  9. 6.1CVE-2022-3803EPSS 0.7%

    A vulnerability was found in eolinker apinto-dashboard and classified as problematic. This issue affects some unknown processing of the file /api/discoveries/. The manipulation leads to cross site scripting. The attack may be initiated rem…

  10. 8.8CVE-2022-3802EPSS 0.6%

    A vulnerability has been found in IBAX go-ibax and classified as critical. This vulnerability affects unknown code of the file /api/v2/open/rowsInfo. The manipulation of the argument where leads to sql injection. The attack can be initiate…

  11. 8.8CVE-2022-3801EPSS 30%

    A vulnerability, which was classified as critical, was found in IBAX go-ibax. This affects an unknown part of the file /api/v2/open/rowsInfo. The manipulation of the argument order leads to sql injection. It is possible to initiate the att…

  12. 8.8CVE-2022-3800ExploitEPSS 3.1%

    A vulnerability, which was classified as critical, has been found in IBAX go-ibax. Affected by this issue is some unknown functionality of the file /api/v2/open/rowsInfo. The manipulation of the argument table_name leads to sql injection. …

  13. 8.8CVE-2022-3799EPSS 0.8%

    A vulnerability classified as critical was found in IBAX go-ibax. Affected by this vulnerability is an unknown functionality of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. The attack can be launched remotely.…

  14. 8.8CVE-2022-3798EPSS 0.6%

    A vulnerability classified as critical has been found in IBAX go-ibax. Affected is an unknown function of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit …

  15. 9.8CVE-2022-3789EPSS 0.8%

    A vulnerability has been found in Tim Campus Confession Wall and classified as critical. Affected by this vulnerability is an unknown functionality of the file share.php. The manipulation of the argument post_id leads to sql injection. The…

  16. 6.1CVE-2022-3783EPSS 0.8%

    A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component ui_text Format Handler. The ma…

  17. 8.8CVE-2022-3733EPSS 0.7%

    A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. This affects an unknown part of the file Admin/edit-admin.php. The manipulation of the argument id leads to sql injection. …

  18. 9.8CVE-2022-3732EPSS 0.5%

    A vulnerability was found in seccome Ehoney and classified as critical. Affected by this issue is some unknown functionality of the file /api/v1/bait/set. The manipulation of the argument Payload leads to sql injection. The attack may be l…

  19. 9.8CVE-2022-3731EPSS 0.5%

    A vulnerability has been found in seccome Ehoney and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/v1/attack/token. The manipulation of the argument Payload leads to sql injection. The …

  20. 9.8CVE-2022-3730EPSS 0.5%

    A vulnerability, which was classified as critical, was found in seccome Ehoney. Affected is an unknown function of the file /api/v1/attack/falco. The manipulation of the argument Payload leads to sql injection. It is possible to launch the…

  21. 9.8CVE-2022-3729EPSS 0.5%

    A vulnerability, which was classified as critical, has been found in seccome Ehoney. This issue affects some unknown processing of the file /api/v1/attack. The manipulation of the argument AttackIP leads to sql injection. The attack may be…

  22. 5.4CVE-2022-3716EPSS 0.4%

    A vulnerability classified as problematic was found in SourceCodester Online Medicine Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /omos/admin/?page=user/list. The manipulation of the argument…

  23. 9.8CVE-2022-3714EPSS 0.5%

    A vulnerability classified as critical has been found in SourceCodester Online Medicine Ordering System 1.0. Affected is an unknown function of the file admin/?page=orders/view_order. The manipulation of the argument id leads to sql inject…

  24. 5.4CVE-2022-3704EPSS 0.9%

    A vulnerability classified as problematic has been found in Ruby on Rails. This affects an unknown part of the file actionpack/lib/action_dispatch/middleware/templates/routes/_table.html.erb. The manipulation leads to cross site scripting.…

  25. 6.1CVE-2022-3673EPSS 0.4%

    A vulnerability, which was classified as problematic, was found in SourceCodester Sanitization Management System 1.0. Affected is an unknown function of the file /php-sms/classes/Master.php. The manipulation of the argument message leads t…

  26. 6.1CVE-2022-3672EPSS 0.4%

    A vulnerability, which was classified as problematic, has been found in SourceCodester Sanitization Management System 1.0. This issue affects some unknown processing of the file /php-sms/classes/SystemSettings.php. The manipulation of the …

  27. 5.4CVE-2022-3587EPSS 0.6%

    A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component My Account. The manipulation of the arg…

  28. 8.8CVE-2022-3584EPSS 0.8%

    A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file edituser.php. The manipulation of the argument id leads to sql injection. The …

  29. 9.8CVE-2022-3583EPSS 0.9%

    A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument business leads to sql injection. T…

  30. 6.1CVE-2022-3581EPSS 0.4%

    A vulnerability, which was classified as problematic, was found in SourceCodester Cashier Queuing System 1.0. Affected is an unknown function of the component Cashiers Tab. The manipulation of the argument Name leads to cross site scriptin…

  31. 6.1CVE-2022-3580EPSS 0.4%

    A vulnerability, which was classified as problematic, has been found in SourceCodester Cashier Queuing System 1.0.1. This issue affects some unknown processing of the component User Creation Handler. The manipulation leads to cross site sc…

  32. 9.8CVE-2022-3579EPSS 0.8%

    A vulnerability classified as critical was found in SourceCodester Cashier Queuing System 1.0. This vulnerability affects unknown code of the file /queuing/login.php of the component Login Page. The manipulation of the argument username/pa…

  33. 4.8CVE-2022-3548EPSS 0.7%

    A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the component Add New Storage Handler. The manipulation of the argument …

  34. 4.8CVE-2022-3547EPSS 0.6%

    A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /csms/admin/?page=system_info of the component Setting Handler. The mani…

  35. 4.8CVE-2022-3546EPSS 0.7%

    A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /csms/admin/?page=user/list of the component Create User …

  36. 6.1CVE-2022-3519EPSS 0.4%

    A vulnerability classified as problematic was found in SourceCodester Sanitization Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Quote Requests Tab. The manipulation of the argument Mana…

  37. 4.8CVE-2022-3518EPSS 0.7%

    A vulnerability classified as problematic has been found in SourceCodester Sanitization Management System 1.0. Affected is an unknown function of the component User Creation Handler. The manipulation of the argument First Name/Middle Name/…

  38. 5.4CVE-2022-3505EPSS 0.6%

    A vulnerability was found in SourceCodester Sanitization Management System. It has been classified as problematic. Affected is an unknown function of the file /php-sms/admin/. The manipulation of the argument page leads to cross site scrip…

  39. 9.8CVE-2022-3504EPSS 0.8%

    A vulnerability was found in SourceCodester Sanitization Management System and classified as critical. This issue affects some unknown processing of the file /php-sms/?p=services/view_service. The manipulation of the argument id leads to s…

  40. 5.4CVE-2022-3503EPSS 0.6%

    A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the component Supplier Handler. The manipulation of the argument Supplier Nam…

  41. 5.4CVE-2022-3502EPSS 0.6%

    A vulnerability was found in Human Resource Management System 1.0. It has been classified as problematic. This affects an unknown part of the component Leave Handler. The manipulation of the argument Reason leads to cross site scripting. I…

  42. 5.4CVE-2022-3497EPSS 0.4%

    A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been classified as problematic. Affected is an unknown function of the component Master List. The manipulation of the argument city/state/country/posi…

  43. 7.2CVE-2022-3495EPSS 0.8%

    A vulnerability has been found in SourceCodester Simple Online Public Access Catalog 1.0 and classified as critical. This vulnerability affects unknown code of the file /opac/Actions.php?a=login of the component Admin Login. The manipulati…

  44. 5.4CVE-2022-3493EPSS 0.4%

    A vulnerability, which was classified as problematic, has been found in SourceCodester Human Resource Management System 1.0. This issue affects some unknown processing of the component Add Employee Handler. The manipulation of the argument…

  45. 8.8CVE-2022-3492EPSS 1.0%

    A vulnerability classified as critical was found in SourceCodester Human Resource Management System 1.0. This vulnerability affects unknown code of the component Profile Photo Handler. The manipulation of the argument parameter leads to os…

  46. 6.5CVE-2022-3473EPSS 0.7%

    A vulnerability classified as critical has been found in SourceCodester Human Resource Management System. This affects an unknown part of the file getstatecity.php. The manipulation of the argument ci leads to sql injection. It is possible…

  47. 4.9CVE-2022-3472EPSS 0.6%

    A vulnerability was found in SourceCodester Human Resource Management System. It has been rated as critical. Affected by this issue is some unknown functionality of the file city.php. The manipulation of the argument cityedit leads to sql …

  48. 4.9CVE-2022-3471EPSS 0.6%

    A vulnerability was found in SourceCodester Human Resource Management System. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file city.php. The manipulation of the argument searccity lea…

  49. 6.5CVE-2022-3470EPSS 0.6%

    A vulnerability was found in SourceCodester Human Resource Management System. It has been classified as critical. Affected is an unknown function of the file getstatecity.php. The manipulation of the argument sc leads to sql injection. It …

  50. 9.8CVE-2022-3467EPSS 0.6%

    A vulnerability classified as critical was found in Jiusi OA. Affected by this vulnerability is an unknown functionality of the file /jsoa/hntdCustomDesktopActionContent. The manipulation of the argument inforid leads to sql injection. The…