CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Description
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-10 · CAPEC-101 · CAPEC-105 · CAPEC-108 · CAPEC-120 · CAPEC-13 · CAPEC-135 · CAPEC-14 · CAPEC-24 · CAPEC-250 · CAPEC-267 · CAPEC-273 · CAPEC-28 · CAPEC-3 · CAPEC-34 · CAPEC-42 · CAPEC-43 · CAPEC-45 · CAPEC-46 · CAPEC-47 · CAPEC-51 · CAPEC-52 · CAPEC-53 · CAPEC-6 · CAPEC-64 · CAPEC-67 · CAPEC-7 · CAPEC-71 · CAPEC-72 · CAPEC-76 · CAPEC-78 · CAPEC-79 · CAPEC-8 · CAPEC-80 · CAPEC-83 · CAPEC-84 · CAPEC-9
CVEs mapped to this weakness (3,064)
page 150 of 154| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-15146 | — | 0.00 | — | 0.01 | Aug 19, 2020 | In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that… | ||
| CVE-2020-16254 | — | 0.00 | — | 0.00 | Aug 5, 2020 | The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute). | ||
| CVE-2020-7698 | 0.00 | — | 0.01 | Jul 29, 2020 | This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized. | |||
| CVE-2020-7695 | — | 0.00 | — | 0.00 | Jul 27, 2020 | Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to… | ||
| CVE-2020-15111 | 0.00 | — | 0.00 | Jul 20, 2020 | In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With… | |||
| CVE-2020-8186 | — | 0.00 | — | 0.01 | Jul 10, 2020 | A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input to the `certificateFor` function. | ||
| CVE-2020-11994 | — | 0.00 | — | 0.02 | Jul 8, 2020 | Server-Side Template Injection and arbitrary file disclosure on Camel templating components | ||
| CVE-2020-15515 | — | 0.00 | — | 0.02 | Jul 7, 2020 | The turn extension through 0.3.2 for TYPO3 allows Remote Code Execution. | ||
| CVE-2018-21268 | — | 0.00 | — | 0.07 | Jun 25, 2020 | The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a… | ||
| CVE-2020-9495 | 0.00 | — | 0.27 | Jun 19, 2020 | Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to… | |||
| CVE-2020-13445 | — | 0.00 | — | 0.04 | Jun 10, 2020 | In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker… | ||
| CVE-2020-1960 | — | 0.00 | — | 0.00 | May 14, 2020 | A vulnerability in Apache Flink (1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to 1.8.3, 1.9.0 to 1.9.2, 1.10.0) where, when running a process with an enabled JMXReporter, with a port configured via… | ||
| CVE-2020-12790 | — | 0.00 | — | 0.00 | May 11, 2020 | In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon. | ||
| CVE-2020-11056 | — | 0.00 | — | 0.01 | May 7, 2020 | In Sprout Forms before 3.9.0, there is a potential Server-Side Template Injection vulnerability when using custom fields in Notification Emails which could lead to the execution of Twig code. This has been fixed in 3.9.0. | ||
| CVE-2020-11002 | 0.00 | — | 0.01 | Apr 10, 2020 | dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE)… | |||
| CVE-2020-7613 | — | 0.00 | — | 0.02 | Apr 7, 2020 | clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the `_is_clamav_binary` function located within `Index.js`. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with… | ||
| CVE-2020-7635 | — | 0.00 | — | 0.01 | Apr 6, 2020 | compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument. | ||
| CVE-2020-10960 | — | 0.00 | — | 0.00 | Apr 3, 2020 | In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows… | ||
| CVE-2020-1958 | — | 0.00 | — | 0.16 | Apr 1, 2020 | When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject… | ||
| CVE-2019-12416 | — | 0.00 | — | 0.01 | Mar 19, 2020 | we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWindowStrategy which is not the default. |
- CVE-2020-15146Aug 19, 2020risk 0.00cvss —epss 0.01
In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that…
- CVE-2020-16254Aug 5, 2020risk 0.00cvss —epss 0.00
The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute).
- CVE-2020-7698Jul 29, 2020risk 0.00cvss —epss 0.01
This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized.
- CVE-2020-7695Jul 27, 2020risk 0.00cvss —epss 0.00
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to…
- CVE-2020-15111Jul 20, 2020risk 0.00cvss —epss 0.00
In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With…
- CVE-2020-8186Jul 10, 2020risk 0.00cvss —epss 0.01
A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input to the `certificateFor` function.
- CVE-2020-11994Jul 8, 2020risk 0.00cvss —epss 0.02
Server-Side Template Injection and arbitrary file disclosure on Camel templating components
- CVE-2020-15515Jul 7, 2020risk 0.00cvss —epss 0.02
The turn extension through 0.3.2 for TYPO3 allows Remote Code Execution.
- CVE-2018-21268Jun 25, 2020risk 0.00cvss —epss 0.07
The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a…
- CVE-2020-9495Jun 19, 2020risk 0.00cvss —epss 0.27
Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to…
- CVE-2020-13445Jun 10, 2020risk 0.00cvss —epss 0.04
In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker…
- CVE-2020-1960May 14, 2020risk 0.00cvss —epss 0.00
A vulnerability in Apache Flink (1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to 1.8.3, 1.9.0 to 1.9.2, 1.10.0) where, when running a process with an enabled JMXReporter, with a port configured via…
- CVE-2020-12790May 11, 2020risk 0.00cvss —epss 0.00
In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon.
- CVE-2020-11056May 7, 2020risk 0.00cvss —epss 0.01
In Sprout Forms before 3.9.0, there is a potential Server-Side Template Injection vulnerability when using custom fields in Notification Emails which could lead to the execution of Twig code. This has been fixed in 3.9.0.
- CVE-2020-11002Apr 10, 2020risk 0.00cvss —epss 0.01
dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE)…
- CVE-2020-7613Apr 7, 2020risk 0.00cvss —epss 0.02
clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the `_is_clamav_binary` function located within `Index.js`. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with…
- CVE-2020-7635Apr 6, 2020risk 0.00cvss —epss 0.01
compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument.
- CVE-2020-10960Apr 3, 2020risk 0.00cvss —epss 0.00
In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows…
- CVE-2020-1958Apr 1, 2020risk 0.00cvss —epss 0.16
When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject…
- CVE-2019-12416Mar 19, 2020risk 0.00cvss —epss 0.01
we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWindowStrategy which is not the default.