CWE-74 - CERT CVE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

CAPEC ID Naziv
CAPEC-10 Buffer Overflow via Environment Variables
CAPEC-101 Server Side Include (SSI) Injection
CAPEC-108 Command Line Execution through SQL Injection
CAPEC-120 Double Encoding
CAPEC-13 Subverting Environment Variable Values
CAPEC-135 Format String Injection
CAPEC-14 Client-side Injection-induced Buffer Overflow
CAPEC-24 Filter Failure through Buffer Overflow
CAPEC-250 XML Injection
CAPEC-267 Leverage Alternate Encoding
CAPEC-273 HTTP Response Smuggling
CAPEC-28 Fuzzing
CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
CAPEC-34 HTTP Response Splitting
CAPEC-42 MIME Conversion
CAPEC-43 Exploiting Multiple Input Interpretation Layers
CAPEC-45 Buffer Overflow via Symbolic Links
CAPEC-46 Overflow Variables and Tags
CAPEC-47 Buffer Overflow via Parameter Expansion
CAPEC-51 Poison Web Service Registry
CAPEC-52 Embedding NULL Bytes
CAPEC-53 Postfix, Null Terminate, and Backslash
CAPEC-6 Argument Injection
CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic
CAPEC-67 String Format Overflow in syslog()
CAPEC-7 Blind SQL Injection
CAPEC-71 Using Unicode Encoding to Bypass Validation Logic
CAPEC-72 URL Encoding
CAPEC-76 Manipulating Web Input to File System Calls
CAPEC-78 Using Escaped Slashes in Alternate Encoding
CAPEC-79 Using Slashes in Alternate Encoding
CAPEC-8 Buffer Overflow in an API Call
CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic
CAPEC-83 XPath Injection
CAPEC-84 XQuery Injection
CAPEC-9 Buffer Overflow in Local Command-Line Utilities