cve.bz

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection), page 106

Filter

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

What the weakness is: CWE-74 at MITRE

Ask an AI about CWE-74

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/74.html and https://cve.bz/cve/cwe/74?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2021-26068EPSS 3.0%

    An endpoint in Atlassian Jira Server for Slack plugin from version 0.0.3 before version 2.0.15 allows remote attackers to execute arbitrary code via a template injection vulnerability.

  2. 8.8CVE-2020-12873EPSS 1.7%

    An issue was discovered in Alfresco Enterprise Content Management (ECM) before 6.2.1. A user with privileges to edit a FreeMarker template (e.g., a webscript) may execute arbitrary Java code or run arbitrary system commands with the same p…

  3. 7.8CVE-2021-21316EPSS 1.0%

    less-openui5 is an npm package which enables building OpenUI5 themes with Less.js. In less-openui5 before version 0.10., when processing theming resources (i.e. `*.less` files) with less-openui5 that originate from an untrusted source, tho…

  4. 7.5CVE-2020-35564EPSS 0.9%

    An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an outdated and unused component allowing for malicious user input of active code.

  5. 9.8CVE-2020-35775ExploitEPSS 13%

    CITSmart before 9.1.2.23 allows LDAP Injection.

  6. 6.1CVE-2021-20644EPSS 0.6%

    ELECOM WRC-1467GHBK-A allows arbitrary scripts to be executed on the user's web browser by displaying a specially crafted SSID on the web setup page.

  7. 7.5CVE-2021-23335EPSS 1.4%

    All versions of package is-user-valid are vulnerable to LDAP Injection which can lead to either authentication bypass or information exposure.

  8. 9.1CVE-2021-21479ExploitEPSS 10%

    In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity of the system.

  9. 6.5CVE-2021-21141EPSS 5.4%

    Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass file extension policy via a crafted HTML page.

  10. 6.5CVE-2021-21137EPSS 5.9%

    Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page.

  11. 8.8CVE-2021-21305EPSS 13%

    CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "#manipulate!" method inapp…

  12. 6.8CVE-2021-21303EPSS 1.1%

    Helm is open-source software which is essentially "The Kubernetes Package Manager". Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. In Helm from version 3.0 and before version 3.5.2, there a …

  13. 4.1CVE-2021-1221EPSS 1.0%

    A vulnerability in the user interface of Cisco Webex Meetings and Cisco Webex Meetings Server Software could allow an authenticated, remote attacker to inject a hyperlink into a meeting invitation email. The vulnerability is due to insuffi…

  14. 8.8CVE-2021-21277EPSS 2.8%

    angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call "expressions.comp…

  15. 9.8CVE-2020-15690EPSS 3.2%

    In Nim before 1.2.6, the standard library asyncftpclient lacks a check for whether a message contains a newline character.

  16. 9.8CVE-2021-21278EPSS 1.6%

    RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 (non-semantic versioning) there is a risk of code injection. Some routes use `eval` or `Function constructor`, which may be injected…

  17. 5.3CVE-2021-21263EPSS 1.6%

    Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is craf…

  18. 8.8CVE-2021-21249EPSS 3.1%

    OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files, OneDev uses SnakeYaml which by d…

  19. 8.8CVE-2021-21248EPSS 1.5%

    OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically gen…

  20. 8.8CVE-2021-21247EPSS 1.5%

    OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the application's BasePage registers an AJAX event listener (`AbstractPostAjaxBehavior`) in all pages other than the login page. This listener decodes and deserialize…

  21. 9.8CVE-2021-21242EPSS 74%

    OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` …

  22. 9.8CVE-2021-21244EPSS 1.5%

    OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue wa…

  23. 9.8CVE-2021-21243EPSS 54%

    OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from the request body. These endpoints do not enforce any authentication or authorizati…

  24. 8.8CVE-2021-21261EPSS 0.6%

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a…

  25. 5.4CVE-2020-26298EPSS 1.6%

    Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when proc…

  26. 6.5CVE-2020-5019EPSS 1.3%

    IBM Spectrum Protect Plus 10.1.0 through 10.1.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerabi…

  27. 5.3CVE-2020-27260EPSS 0.4%

    Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 HL7 v2.x injection vulnerabilities exist in the affected products that allow physically proximate attackers with a connected barcode reader to inject HL7 v2.x segments int…

  28. 9.8CVE-2020-28468EPSS 4.4%

    This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code execution.

  29. 6.1CVE-2020-26293EPSS 1.0%

    HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372, there is a possible XSS bypass if style tag is allowed. If you have explicitly…

  30. 9.9CVE-2020-10208EPSS 4.2%

    Command Injection in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series and Kami7B allows authenticated remote attackers to execute arbitrary commands with root user privile…

  31. 8.8CVE-2020-16268EPSS 1.3%

    The MSI installer in 1E Client 4.1.0.267 and 5.0.0.745 allows remote authenticated users and local users to gain elevated privileges via the repair option. This applies to installations that have a TRANSFORM (MST) with the option to disabl…

  32. 10.0CVE-2020-26282EPSS 4.8%

    BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR file. BrowserUp Proxy works well as a standalone proxy server, but it is especially useful when embedded in Se…

  33. 6.1CVE-2020-35669EPSS 2.2%

    An issue was discovered in the http package through 0.12.2 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request.

  34. 7.8CVE-2020-35608EPSS 4.1%

    A code execution vulnerability exists in the normal world’s signed code execution functionality of Microsoft Azure Sphere 20.07. A specially crafted AF_PACKET socket can cause a process to create an executable memory mapping with controlla…

  35. 8.8CVE-2020-27687EPSS 1.5%

    ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails. This allows an attacker to send malicious links in password-reset emails to victims, pointing to an attacker-controlled server. Lack of validation of …

  36. 7.8CVE-2020-8177EPSS 1.3%

    curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

  37. 8.8CVE-2020-25967EPSS 1.3%

    The member center function in fastadmin V1.0.0.20200506_beta is vulnerable to a Server-Side Template Injection (SSTI) vulnerability.

  38. 6.4CVE-2020-26260EPSS 0.8%

    BookStack is a platform for storing and organising information and documentation. In BookStack before version 0.30.5, a user with permissions to edit a page could set certain image URL's to manipulate functionality in the exporting system,…

  39. 7.5CVE-2020-29655EPSS 0.9%

    An injection vulnerability exists in RT-AC88U Download Master before 3.1.0.108. Accessing Main_Login.asp?flag=1&productname=FOOBAR&url=/downloadmaster/task.asp will redirect to the login site, which will show the value of the parameter pro…

  40. 5.4CVE-2020-14193EPSS 0.8%

    Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside the WEB-INF/classes & <jira-installation>/jira/bin directories via a template injection vulnerability…

  41. 8.1CVE-2020-26238EPSS 4.2%

    Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitra…

  42. 9.8CVE-2020-13942ExploitEPSS 69%

    It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the…

  43. 6.1CVE-2020-26081EPSS 0.8%

    Multiple vulnerabilities in the web UI of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against users on an affected system. The vulnerabilities are due…

  44. 6.1CVE-2020-26884EPSS 0.8%

    RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user into executing malicious JavaScript code i…

  45. 6.1CVE-2020-27627EPSS 0.7%

    JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection.

  46. 8.8CVE-2020-26222EPSS 3.1%

    Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go. In Dependabot-Core from version 0.119.0.beta1 before version 0.125.1, there is a remote code execu…

  47. 4.3CVE-2020-28031EPSS 0.6%

    eramba through c2.8.1 allows HTTP Host header injection with (for example) resultant wkhtml2pdf PDF printing by authenticated users.

  48. 7.0CVE-2020-15238ExploitEPSS 4.6%

    Blueman is a GTK+ Bluetooth Manager. In Blueman before 2.1.4, the DhcpClient method of the D-Bus interface to blueman-mechanism is prone to an argument injection vulnerability. The impact highly depends on the system configuration. If Polk…

  49. 7.2CVE-2020-15244EPSS 1.3%

    In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue …

  50. 4.7CVE-2020-3561EPSS 1.3%

    A vulnerability in the Clientless SSL VPN (WebVPN) of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to inject arbitrary HTTP headers in th…