Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,035 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 9.8 Critical severity
Waap Cloud: Improper Neutralization of Special Elements in Output Used by a Downstream Component
In UBIKA WAAP Gateway/Cloud through 6.10, a blind XPath injection leads to an authentication bypass by stealing the session of another connected user. The fixed versions are WAAP Gateway & Cloud 6.11.0 and 6.5.6-patch15.
- 9.9 Critical severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installat
- 7.8 High severity
Debmany: Improper Neutralization of Special Elements in Output Used by a Downstream Component
debmany in debian-goodies 0.88.1 allows attackers to execute arbitrary shell commands (because of an eval call) via a crafted .deb file. (The path is shown to the user before execution.)
- 8.8 High severity
Doctors Appointment System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in SourceCodester Doctors Appointment System 1.0. This issue affects some unknown processing of the file /admin/edit-doc.php. The manipulation of the argument email/oldmail leads to sql injectio
- 8.8 High severity
Doctors Appointment System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/doctors.php of the component Parameter Handler. The manipulation of the argument search/id leads to sq
- 7.2 High severity
VMware Carbon Black App Control: Improper Neutralization of Special Elements in Output Used by a Downstream Component
VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with privileged access to the App Control administration console may be able to use specially crafted inp
- 7.5 High severity
Apache Sling JCR Base: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Apache Sling JCR Base < 3.1.12 has a critical injection vulnerability when running on old JDK versions (JDK 1.8.191 or earlier) through utility functions in RepositoryAccessor. The functions getRepository and getRepositoryFromURL allow an application to access
- 8.8 High severity
Control: Improper Neutralization of Special Elements in Output Used by a Downstream Component
ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.exe h parameter. This results in reflected data and injection of malicious code into a downloaded execu
- 7.5 High severity
Rancher: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SUSE Rancher allows remote attackers to cause denial of service by supplying specially crafted git credentials. This issue affects: SUSE Ranch
- 7.1 High severity
Common Desktop Environment: Improper Neutralization of Special Elements in Output Used by a Downstream Component
dtprintinfo in Common Desktop Environment 1.6 has a bug in the parser of lpstat (an invoked external command) during listing of the names of available printers. This allows low-privileged local users to inject arbitrary printer names via the $HOME/.printers fi
- 8.8 High severity
Swift Foundation: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A program using FoundationNetworking in swift-corelibs-foundation is potentially vulnerable to CRLF ( ) injection in URLRequest headers. In this vulnerability, a client can insert one or several CRLF sequences into a URLRequest header value. When that request
- 7.5 High severity
Async HTTP Client: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users ar
- 7.5 High severity
LDAP Integration with Active Directory and…: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to LDAP Injection since is not properly sanitizing the 'username' POST parameter. An attacker can manipulate this paramter to dump arbitrary contents form
- 7.8 High severity
Omniverse Audio2Face: Improper Control of Generation of Code
Omniverse Kit contains a vulnerability in the reference applications Create, Audio2Face, Isaac Sim, View, Code, and Machinima. These applications allow executable Python code to be embedded in Universal Scene Description (USD) files to customize all aspects of
- 7.8 High severity
HPE Superdome Flex Server; HPE Superdome Flex…: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. The vulnerability could be exploited to allow local unauthorized data injection. HPE has made the following software updates to resolve the vulnerabili
- 9.8 Critical severity
merou: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Dropbox merou. It has been classified as critical. Affected is the function add_public_key of the file grouper/public_key.py of the component SSH Public Key Handler. The manipulation of the argument public_key_str leads to injectio
- 8.8 High severity
Firefox: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Because Firefox did not implement the <code>unsafe-hashes</code> CSP directive, an attacker who was able to inject markup into a page otherwise protected by a Content Security Policy may have been able to inject executable script. This would be severely constr
- 9.8 Critical severity
This vulnerable is about a potential code injection when an attacker has control of the target…
This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource use InitialContext.l
- 7.8 High severity
Android: Improper Neutralization of Special Elements in Output Used by a Downstream Component
In getView of AddAppNetworksFragment.java, there is a possible way to mislead the user about network add requests due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interactio
- 9.8 Critical severity
rxvt-unicode: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set.
- 9.8 Critical severity
AX8: Improper Neutralization of Special Elements used in an OS Command
A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. Affected by this issue is some unknown functionality of the file palette.php of the component Web Service Handler. The manipulation of the argument palette leads to command injection. The attac
- 9.8 Critical severity
Cacti Command Injection Exploited
Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server
- 7.1 High severity
Proxmox Mail Gateway: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side D
- 9.8 Critical severity
discourse-bbcode: Improper Neutralization of Input During Web Page Generation
discourse-bbcode is the official BBCode plugin for Discourse. Prior to commit 91478f5, CSS injection can occur when rendering content generated with the discourse-bccode plugin. This vulnerability only affects sites which have the discourse-bbcode plugin insta
- 8.8 High severity
xwiki-platform: Improper Encoding or Escaping of Output
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on commonly accessible documents including the menu macro can execute arbitrary Groovy, Python or Velocity code in XWiki leading
- 9.8 Critical severity
parse-server: Improperly Controlled Modification of Object Prototype Attributes
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that are specified in the Parse Server option `requestKeywordDenylist` can be injected via Cloud Code Webhoo
- 9.8 Critical severity
keystone: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Keystone is a headless CMS for Node.js — built with GraphQL and React.`@keystone-6/[email protected] || 3.0.1` users that use `NODE_ENV` to trigger security-sensitive functionality in their production builds are vulnerable to `NODE_ENV` being inlined to `"development
- 8.8 High severity
Hubshare: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload.
- 9.8 Critical severity
Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE)…
Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
- 9.9 Critical severity
GitLab: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.
- 7.2 High severity
mybb: Improper Neutralization of Special Elements used in a Command
MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information
- 7.5 High severity
SwiftNIO: Improper Neutralization of Special Elements in Output Used by a Downstream Component
NIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack. This occurs when a HTTP/1.1 server accepts user generated input from an incoming request and reflects it into a HTTP/1.1 response header in some fo
- 9.8 Critical severity
Teclib GLPI Remote Code Execution Exploited
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
- 9.8 Critical severity
ghas-to-csv: Improper Neutralization of Special Elements in Output Used by a Downstream Component
some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an a
- 8.8 High severity
cruddl: Improper Neutralization of Special Elements in Output Used by a Downstream Component
cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses `@flexSearchFulltext`, users of that schem
- 7.2 High severity
Snypr: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An injection vulnerability in the syslog-ng configuration wizard in Securonix Snypr 6.4 allows an application user with the "Manage Ingesters" permission to execute arbitrary code on remote ingesters by appending arbitrary text to text files that are executed
- 9.8 Critical severity
Tabit: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Tabit - HTTP Method manipulation. https://bridge.tabit.cloud/configuration/addresses-query - can be POST-ed to add addresses to the DB. This is an example of OWASP:API8 – Injection.
- 8.8 High severity
Eyes of Network Web: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper neutralization of special elements leaves the Eyes of Network Web application vulnerable to an iFrame injection attack, via the url parameter of /module/module_frame/index.php.
- 7.2 High severity
RUGGEDCOM RM1224 LTE(4G) EU: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell.
- 7.2 High severity
VMware Workspace ONE Access, Identity Manager…: Improper Neutralization of Special Elements in Output Used by a Downstream Component
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution.