Improper Neutralization of Invalid Characters in Identifiers in Web Pages
CWE-86
The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.
We track 4 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7.
Latest Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerabilities
- 7.8 High severity
vim: Improper Neutralization of Special Elements used in an OS Command
Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an a
- 9.6 Critical severity
FAST/TOOLS: Improper Neutralization of Invalid Characters in Identifiers in Web Pages
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly encode URLs. An attacker could tamper with web pages or execute malicious scripts. The affected products and versions are as follows: FAST/TO
- 7.8 High severity
Intel(R) Arc(TM) & Iris(R) Xe Graphics software: Improper Neutralization of Invalid Characters in Identifiers in Web Pages
Improper neutralization in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.5081 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent network access.
- 9.6 Critical severity
xwiki-commons: Improper Neutralization of Input During Web Page Generation
`org.xwiki.commons:xwiki-commons-xml` is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. Thi