CWE-790
Improper Filtering of Special Elements
Description
The product receives data from an upstream component, but does not filter or incorrectly filters special elements before sending it to a downstream component.
Hierarchy (View 1000)
CVEs mapped to this weakness (15)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-43802 | Cri | 0.65 | 9.9 | 0.02 | Dec 9, 2021 | Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an `*.etherpad` file that, when imported, might allow the attacker to gain admin privileges for the Etherpad instance. This, in turn, can be used to install a malicious Etherpad… | ||
| CVE-2023-22578 | Cri | 0.58 | 10.0 | 0.01 | Feb 16, 2023 | Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections. | ||
| CVE-2024-42416 | Hig | 0.57 | 8.8 | 0.00 | Sep 5, 2024 | The ctl_report_supported_opcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kernel help memory. Malicious software running in a guest VM that exposes virtio_scsi can exploit the vulnerabilities to… | ||
| CVE-2024-31616 | Hig | 0.57 | 8.8 | 0.01 | Apr 23, 2024 | An issue discovered in RG-RSR10-01G-T(W)-S and RG-RSR10-01G-T(WA)-S routers with firmware version RSR10-01G-T-S_RSR_3.0(1)B9P2, Release(07150910) allows attackers to execute arbitrary code via the common_quick_config.lua file. | ||
| CVE-2026-2328 | — | Hig | 0.49 | 7.5 | 0.00 | Mar 30, 2026 | An unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their intended scope via path traversal, resulting in exposure of sensitive information. | |
| CVE-2025-27260 | Hig | 0.49 | 7.5 | 0.00 | Mar 25, 2026 | Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains an Improper Filtering of Special Elements vulnerability which, if exploited, can lead to unauthorized modification of certain information | ||
| CVE-2025-15576 | Hig | 0.49 | 7.5 | 0.00 | Mar 9, 2026 | If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the two jail root directories is an ancestor of the other, jailed processes may nonetheless be able to access a shared directory via a nullfs mount, if the administrator has… | ||
| CVE-2026-9658 | Hig | 0.47 | 7.3 | 0.00 | May 28, 2026 | Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example, GET… | ||
| CVE-2025-0431 | Med | 0.38 | 5.8 | 0.00 | Mar 19, 2025 | Enterprise Protection contains a vulnerability in URL rewriting that allows an unauthenticated remote attacker to send an email which bypasses URL protections impacting the integrity of recipient's email. This occurs due to improper filtering of backslashes within URLs and… | ||
| CVE-2024-6540 | Med | 0.37 | 5.7 | 0.00 | Jul 15, 2024 | Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download a list of tickets containing information about tickets of other customers. The problem only occurs if the… | ||
| CVE-2024-43443 | Med | 0.32 | 4.9 | 0.00 | Aug 26, 2024 | Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in Process Management modules of OTRS and ((OTRS)) Community Edition allows Cross-Site Scripting (XSS) within the Process Management targeting other admins. This issue affects: … | ||
| CVE-2024-43442 | Med | 0.32 | 4.9 | 0.00 | Aug 26, 2024 | Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in OTRS (System Configuration modules) and ((OTRS)) Community Edition allows Cross-Site Scripting (XSS) within the System Configuration targeting other admins. This issue… | ||
| CVE-2024-47984 | Med | 0.29 | 4.4 | 0.00 | Dec 13, 2024 | Dell RecoverPoint for Virtual Machines 6.0.x contains Denial of Service vulnerability. A User with Remote access could potentially exploit this vulnerability, leading to the disruption of most functionalities of the RPA persistent after reboot, resulting in need of technical… | ||
| CVE-2026-11331 | Hig | 0.00 | 7.5 | 0.00 | Jul 22, 2026 | An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an… | ||
| CVE-2023-45239 | Cri | 0.00 | 9.8 | 0.02 | Oct 6, 2023 | A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr, or NAC address sent to tac_plus to inject shell commands and gain remote code execution on the… |
- risk 0.65cvss 9.9epss 0.02
Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an `*.etherpad` file that, when imported, might allow the attacker to gain admin privileges for the Etherpad instance. This, in turn, can be used to install a malicious Etherpad…
- risk 0.58cvss 10.0epss 0.01
Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections.
- risk 0.57cvss 8.8epss 0.00
The ctl_report_supported_opcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kernel help memory. Malicious software running in a guest VM that exposes virtio_scsi can exploit the vulnerabilities to…
- risk 0.57cvss 8.8epss 0.01
An issue discovered in RG-RSR10-01G-T(W)-S and RG-RSR10-01G-T(WA)-S routers with firmware version RSR10-01G-T-S_RSR_3.0(1)B9P2, Release(07150910) allows attackers to execute arbitrary code via the common_quick_config.lua file.
- risk 0.49cvss 7.5epss 0.00
An unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their intended scope via path traversal, resulting in exposure of sensitive information.
- risk 0.49cvss 7.5epss 0.00
Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains an Improper Filtering of Special Elements vulnerability which, if exploited, can lead to unauthorized modification of certain information
- risk 0.49cvss 7.5epss 0.00
If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the two jail root directories is an ancestor of the other, jailed processes may nonetheless be able to access a shared directory via a nullfs mount, if the administrator has…
- risk 0.47cvss 7.3epss 0.00
Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example, GET…
- risk 0.38cvss 5.8epss 0.00
Enterprise Protection contains a vulnerability in URL rewriting that allows an unauthenticated remote attacker to send an email which bypasses URL protections impacting the integrity of recipient's email. This occurs due to improper filtering of backslashes within URLs and…
- risk 0.37cvss 5.7epss 0.00
Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download a list of tickets containing information about tickets of other customers. The problem only occurs if the…
- risk 0.32cvss 4.9epss 0.00
Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in Process Management modules of OTRS and ((OTRS)) Community Edition allows Cross-Site Scripting (XSS) within the Process Management targeting other admins. This issue affects: …
- risk 0.32cvss 4.9epss 0.00
Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in OTRS (System Configuration modules) and ((OTRS)) Community Edition allows Cross-Site Scripting (XSS) within the System Configuration targeting other admins. This issue…
- risk 0.29cvss 4.4epss 0.00
Dell RecoverPoint for Virtual Machines 6.0.x contains Denial of Service vulnerability. A User with Remote access could potentially exploit this vulnerability, leading to the disruption of most functionalities of the RPA persistent after reboot, resulting in need of technical…
- risk 0.00cvss 7.5epss 0.00
An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It also may lead to an…
- risk 0.00cvss 9.8epss 0.02
A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr, or NAC address sent to tac_plus to inject shell commands and gain remote code execution on the…