Improper Filtering of Special Elements
CWE-790
The product receives data from an upstream component, but it does not filter or incorrectly filters special elements before sending it to a downstream component.
We track 8 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1.
Latest Improper Filtering of Special Elements vulnerabilities
- 7.5 High severity
BIND 9: Improper Filtering of Special Elements
An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It
- 7.3 High severity
Plack::Middleware::Security::Common: Improper Neutralization of CRLF Sequences in HTTP Headers
Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example, GET
- 7.5 High severity
Device Sphere: Improper Filtering of Special Elements
An unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their intended scope via path traversal, resulting in exposure of sensitive information.
- 7.5 High severity
Indoor Connect 8855: Improper Filtering of Special Elements
Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains an Improper Filtering of Special Elements vulnerability which, if exploited, can lead to unauthorized modification of certain information
- 7.5 High severity
FreeBSD: Improper Privilege Management
If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the two jail root directories is an ancestor of the other, jailed processes may nonetheless be able to access a shared directory via a nullfs mount, if the admini
- 8.8 High severity
FreeBSD: Improper Validation of Specified Quantity in Input
The ctl_report_supported_opcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kernel help memory. Malicious software running in a guest VM that exposes virtio_scsi can exploit the vuln
- 8.8 High severity
rg-rsr10-01g-t: Improper Filtering of Special Elements
An issue discovered in RG-RSR10-01G-T(W)-S and RG-RSR10-01G-T(WA)-S routers with firmware version RSR10-01G-T-S_RSR_3.0(1)B9P2, Release(07150910) allows attackers to execute arbitrary code via the common_quick_config.lua file.
- 9.8 Critical severity
tac_plus: Improper Filtering of Special Elements
A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr, or NAC address sent to tac_plus to inject shell commands and gain remote code ex