Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-74
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
We track 4,035 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 13 have been exploited in real attacks.
How this weakness is prevented
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Latest Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerabilities
- 7.2 High severity
Sugarcrm: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Second-Order PHP Object Injection vulnerability has been identified in the DocuSign module. By using crafted requests, custom PHP code can be injected and executed through t
- 9.8 Critical severity
cmd/go: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo L
- 8.8 High severity
Pydio Cells: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code of the component User Creation Handler. The manipulation leads to improper control of resource identifiers. The attack can be initiated remo
- 7.2 High severity
Apache Airflow CNCF Kubernetes Provider: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to
- 8.8 High severity
yhirose/cpp-httplib: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests. This can lead to logical errors and other misbehav
- 7.2 High severity
cms: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Craft CMS is an open source content management system. In affected versions of Craft CMS an unrestricted file extension may lead to Remote Code Execution. If the name parameter value is not empty string('') in the View.php's doesTemplateExist() -> resolveTempl
- 10.0 Critical severity
vm2: Improper Neutralization of Special Elements in Output Used by a Downstream Component
vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a resul
- 7.3 High severity
html/template: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.
- 7.3 High severity
html/template: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if
- 8.8 High severity
Apache Ranger: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0.
- 9.8 Critical severity
Ejs: Improper Neutralization of Special Elements in Output Used by a Downstream Component
ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render funct
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown function of the component Web Management Interface. This manipulation of the argument suffix-rate-up causes command injection. The attack may be initiated remotely. Th
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The impacted element is an unknown function of the component Web Management Interface. The manipulation of the argument Name results in command injection. The attack can be launched re
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The affected element is an unknown function of the component Web Management Interface. The manipulation of the argument dpi leads to command injection. The attack can be
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. Impacted is an unknown function of the component Web Management Interface. Executing a manipulation of the argument src can lead to command injection. It is possible to launch the at
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This issue affects some unknown processing of the component Web Management Interface. Performing a manipulation of the argument ecn-down results in command injection. It is poss
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This vulnerability affects unknown code of the component Web Management Interface. Such manipulation of the argument ecn-up leads to command injection. The attack may be performed fr
- 7.8 High severity
git: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit
- 7.2 High severity
Strapi: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions a user without script or programming right may edit a user profile (or any other document) with the wiki editor and add groovy script
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to display or interact with any page a user cannot access through the combination of the async and display macros. A com
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the `since` parameter of the `/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdmini
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute anything with the right of the Scheduler Application sheet page. A user without script or programming rights, edit your user profi
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros that allow remote code execution includ
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted re
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause i
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A registered user can perform remote code execution leading to privilege escalation by injecting the proper code in the "property" field of an attachment s
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause i
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on `XWiki.AttachmentSelector` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on any document (e.g., their own user profile) can execute code with programming rights, leading to remote code execution. This v
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page (e.g., it's own user page), can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to th
- 8.8 High severity
xwiki-platform: Improper Neutralization of Special Elements in Output Used by a Downstream Component
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In XWiki, every user can add translations that are only applied to the current user. This also allows overriding existing translations. Such translations a
- 10.0 Critical severity
vm2: Improper Neutralization of Special Elements in Output Used by a Downstream Component
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()`
- 8.8 High severity
xwiki-platform: Cross-Site Request Forgery
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of `org.xwiki.platform:xwiki-platform-logging-ui` it is possible to trick a user with programming rights into visiting a constructed u
- 7.2 High severity
Nashorn Sandbox: Improper Neutralization of Special Elements in Output Used by a Downstream Component
delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. When allowExitFunctions is set to false, the loadWithNewGlobal function can be used to invoke the exit and quit methods to exit the Java process.
- 7.2 High severity
Hitachi Vantara Pentaho BA Server Special Element Injection Exploited
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.
- 8.8 High severity
https://github.com/curl/curl: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an a
- 8.8 High severity
dataease: Improper Neutralization of Special Elements in Output Used by a Downstream Component
DataEase is an open source data visualization analysis tool. In Dataease users are normally allowed to modify data and the data sources are expected to properly sanitize data. The AWS redshift data source does not provide data sanitization which may lead to re
- 8.8 High severity
cocos-engine: Improper Neutralization of Special Elements used in a Command
Cocos Engine is an open-source framework for building 2D & 3D real-time rendering and interactive content. In the github repo for Cocos Engine the `web-interface-check.yml` was subject to command injection. The `web-interface-check.yml` was triggered when a pu
- 8.8 High severity
Business Objects Business Intelligence…: Improper Neutralization of Special Elements in Output Used by a Downstream Component
In some scenario, SAP Business Objects Business Intelligence Platform (CMC) - versions 420, 430, Program Object execution can lead to code injection vulnerability which could allow an attacker to gain access to resources that are allowed by extra privileges. S