cve.bz

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection), page 112

Filter

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

What the weakness is: CWE-74 at MITRE

Ask an AI about CWE-74

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/74.html and https://cve.bz/cve/cwe/74?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2016-8899EPSS 2.1%

    Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expCatController.php related to change_cats.

  2. 9.8CVE-2016-8901EPSS 2.4%

    b2evolution 6.7.6 suffer from an Object Injection vulnerability in /htsrv/call_plugin.php.

  3. 6.1CVE-2019-3562EPSS 1.1%

    A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the Oculus Browser starting from version 5.2.7 until 5.7.11.

  4. 9.8CVE-2019-2725KEVExploitEPSS >99.9%

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated att…

  5. 8.3CVE-2019-9900EPSS 3.7%

    When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matc…

  6. 7.8CVE-2019-11354ExploitEPSS 23%

    The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an …

  7. 5.4CVE-2018-1943EPSS 1.0%

    IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inje…

  8. 6.1CVE-2015-5462EPSS 1.0%

    AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier allows remote attackers to inject HTML into the scoping dashboard features.

  9. 5.9CVE-2018-4153EPSS 0.9%

    An injection issue was addressed with improved validation. This issue affected versions prior to macOS Mojave 10.14.

  10. 8.8CVE-2019-9614EPSS 2.6%

    An issue was discovered in OFCMS before 1.1.3. A command execution vulnerability exists via a template file with '<#assign ex="freemarker.template.utility.Execute"?new()> ${ ex("' followed by the command.

  11. 9.8CVE-2019-8948EPSS 3.9%

    PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163.

  12. 4.3CVE-2019-1680EPSS 1.4%

    A vulnerability in Cisco Webex Business Suite could allow an unauthenticated, remote attacker to inject arbitrary text into a user's browser. The vulnerability is due to improper validation of input. An attacker could exploit this vulnerab…

  13. 9.8CVE-2018-18996EPSS 2.5%

    LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an attacker to execute remote code on the server.

  14. 8.8CVE-2018-18992EPSS 2.0%

    LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper sanitation, which may allow an attacker to execute remote code on the server.

  15. 5.4CVE-2017-1202EPSS 0.8%

    IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context…

  16. 6.5CVE-2019-7351EPSS 1.2%

    Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom Log message provided by the attacker in the 'log' view page, as demonstrated by t…

  17. 9.8CVE-2018-16492EPSS 3.0%

    A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.

  18. 9.8CVE-2018-16491EPSS 1.7%

    A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype.

  19. 7.5CVE-2018-16490EPSS 1.1%

    A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype.

  20. 9.8CVE-2018-16489EPSS 1.8%

    A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions.

  21. 9.8CVE-2018-16486EPSS 1.5%

    A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype.

  22. 6.1CVE-2019-6802ExploitEPSS 3.8%

    CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI.

  23. 6.5CVE-2019-3498EPSS 3.4%

    In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to conten…

  24. 6.1CVE-2018-16627EPSS 0.8%

    panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature.

  25. 9.8CVE-2018-1000854EPSS 3.2%

    esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in ESI directive with user specified XSLT that can result in Re…

  26. 7.5CVE-2018-18250EPSS 1.0%

    Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navigation item.

  27. 7.8CVE-2018-20167EPSS 2.7%

    Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe "cat README.md" command when \e}pn is used. A popmedia control sequence can allow the malicious execution of executable file…

  28. 4.7CVE-2018-1474EPSS 1.2%

    IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject arbitrary H…

  29. 5.4CVE-2018-1896EPSS 1.0%

    IBM Connections 5.0, 5.5, and 6.0 is vulnerable to possible host header injection attack that could cause navigation to the attacker's domain. IBM X-Force ID: 152456.

  30. 6.1CVE-2018-18207EPSS 0.7%

    Virtualmin 6.03 allows Frame Injection via the settings-editor_read.cgi file parameter.

  31. 9.8CVE-2018-16763ExploitEPSS 83%

    FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution.

  32. 5.4CVE-2017-1115EPSS 0.8%

    IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Fo…

  33. 6.8CVE-2018-9062EPSS 0.5%

    In some Lenovo ThinkPad products, one BIOS region is not properly included in the checks, allowing injection of arbitrary code.

  34. 5.4CVE-2018-1549EPSS 0.9%

    IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split re…

  35. 9.8CVE-2018-4995EPSS 7.1%

    Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an XFA '\n' POST injection vulnerability. Successful exploitation could lead to a security bypass.

  36. 8.8CVE-2018-0313EPSS 3.8%

    A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to send a malicious packet to the management interface on an affected system and execute a command-injection exploit. The vulnerabi…

  37. 5.3CVE-2017-7848EPSS 1.7%

    RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird < 52.5.2.

  38. 8.8CVE-2017-7846EPSS 1.9%

    It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View -> Feed article -> Website" or in the standard format of "View -> Feed article -> default format". This vulnerability affects …

  39. 9.8CVE-2017-7788EPSS 2.3%

    When an "iframe" has a "sandbox" attribute and its content is specified using "srcdoc", that content does not inherit the containing page's Content Security Policy (CSP) as it should unless the sandbox attribute included "allow-same-origin…

  40. 5.5CVE-2018-4235EPSS 0.4%

    An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "Messages" component. It allows local …

  41. 4.3CVE-2018-1000193EPSS 1.0%

    A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign up using user names containing control characters that can t…

  42. 6.1CVE-2017-16043EPSS 1.0%

    Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0 <=0.49.3.

  43. 7.8CVE-2017-6015EPSS 0.7%

    Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02 remains ambiguous, which may allow an attacker to link to or run a malicious executable. This may allow an authorized, …

  44. 8.8CVE-2017-18266EPSS 2.4%

    The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks v…

  45. 9.8CVE-2016-10498EPSS 1.2%

    In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9635M, MDM9645, MDM9650, MDM9655, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 617, SD 6…

  46. 9.8CVE-2014-2294EPSS 2.7%

    Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted serialized object in the owa_event parameter to queue.php.

  47. 9.8CVE-2017-0372ExploitEPSS 11%

    Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities.

  48. 4.4CVE-2017-4028EPSS 0.5%

    Maliciously misconfigured registry vulnerability in all Microsoft Windows products in McAfee consumer and corporate products allows an administrator to inject arbitrary code into a debugged McAfee process via manipulation of registry param…

  49. 7.8CVE-2015-1975EPSS 0.5%

    The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, and 6.3 before iFix 37 and IBM Security Directory Server 6.3.1 before iFix 11 and 6.4 before iFix 2 allows loca…

  50. 8.8CVE-2018-4106EPSS 1.7%

    An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the Bracketed Paste Mode of the "Terminal" component. It allows user-assisted attackers to inject arbitrary commands within pasted cont…