CWE-838 Inappropriate Encoding for Output Context
baseThe product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (25)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-6110US | medium6.8 | Exploit | ||
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for ex… | ||||
| CVE-2024-52005US | high8.8 | Exploit | ||
Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the clien… | ||||
| CVE-2019-18981US | critical9.8 | — | ||
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification. | ||||
| CVE-2022-43407US | high8.8 | — | ||
Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' step, which is used for the URLs that p… | ||||
| CVE-2020-10996US | high8.1OT elevated | — | ||
An issue was discovered in Percona XtraDB Cluster before 5.7.28-31.41.2. A bundled script inadvertently sets a static transition_key for SST processes in place of the random key ex… | ||||
| CVE-2019-9853US | high7.8 | — | ||
LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically execution of macros are blocked by default. A URL… | ||||
| CVE-2018-9862US | high7.8 | — | ||
util.c in runV 1.0.0 for Docker mishandles a numeric username, which allows attackers to obtain root access by leveraging the presence of an initial numeric value on an /etc/passwd… | ||||
| CVE-2023-6512US | medium6.5 | — | ||
Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially spoof the contents of an iframe dialog context menu… | ||||
| CVE-2022-43408US | medium6.5 | — | ||
Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proceed or abort Pipeline builds, allowing… | ||||
| CVE-2023-5770US | medium5.4 | — | ||
Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body… | ||||
| CVE-2024-50349US | medium4.7 | — | ||
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks… | ||||
| CVE-2023-3735US | medium4.3 | — | ||
Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chro… | ||||
| CVE-2020-7292US | medium4.3 | — | ||
Inappropriate Encoding for output context vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows a remote attacker to cause MWG to return an ambiguous redirect response vi… | ||||
| CVE-2020-29135US | medium4.1 | — | ||
cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567). | ||||
| CVE-2026-114650US | — | — | ||
A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption. Under… | ||||
| CVE-2026-84463US | — | — | ||
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published… | ||||
| CVE-2026-55859US | — | — | ||
MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the a… | ||||
| CVE-2026-55858US | — | — | ||
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes pr… | ||||
| CVE-2026-47079US | — | — | ||
Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting.
This vulnerability is associated… | ||||
| CVE-2026-53641US | — | — | ||
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) vulnerability in the client-facing em… | ||||
03
attack patterns (1)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan