CWE-150.

Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences

• CWE-150

>=11.0.0-M1, <11.0.11 || >=10.1.0-M1, <10.1.45 || >=9.0.40, <9.0.109 || >=8.5.60, <=8.5.100 · fixed in 11.0.11, 10.1.45, 9.0.109

Logging user input may result in poisoning logs with ANSI escape sequences

• CWE-150

>=0.0.0-0, <0.3.20 · fixed in 0.3.20

Active Record logging vulnerable to ANSI escape injection

• CWE-150

<7.1.5.2 || >=7.2, <7.2.2.2 || >=8.0, <8.0.2.1 · fixed in 7.1.5.2, 7.2.2.2, 8.0.2.1

Apache HTTP Server: mod_ssl error log variable escaping

• Apache Software Foundation Apache HTTP Server
• CWE-150

Gardener allows metadata injection for a project secret which can lead to privilege escalation in github.com/gardener/gardener

• CWE-150

<1.116.4 || >=1.117.0, <1.117.5 || >=1.118.0, <1.118.2 · fixed in 1.116.4, 1.117.5, 1.118.2

Apache Tomcat Rewrite rule bypass

• CWE-116
• CWE-150

>=9.0.76, <9.0.104 || >=10.1.10, <10.1.40 || >=11.0.0-M2, <11.0.6 || >=8.5.0, <=8.5.100 · fixed in 9.0.104, 10.1.40, 11.0.6

BusyBox: In netstat in BusyBox through 1.37.0…

• BusyBox
• CWE-150

gurk (aka gurk-rs) mishandles ANSI escape sequences

• CWE-150

<=0.6.3 · no fixed version yet

IBM MQ code execution

• IBM MQ
• CWE-150

MongoDB Shell may be susceptible to control character Injection via shell output

• CWE-150

<2.3.9 · fixed in 2.3.9

MongoDB Shell may be susceptible to control character injection via pasting

• CWE-150

<2.3.9 · fixed in 2.3.9

Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header

• Other injection
• CWE-150

<=4.0.0 · no fixed version yet

Crayfish allows Remote Code Execution via Homarus Authorization header

• CWE-150
• CWE-157

<4.1.0 · fixed in 4.1.0

The sideband payload is passed unfiltered to the terminal in git

• git
• CWE-116
• CWE-150

Git does not sanitize URLs when asking for credentials interactively

• git
• CWE-116
• CWE-147

Newline confusion in credential helpers can lead to credential exfiltration in git

• git
• CWE-116
• CWE-147

jte's HTML templates containing Javascript template strings are subject to XSS

• Cross-site scripting (XSS)
• CWE-150

<3.1.16 · fixed in 3.1.16

python-sql SQL injection vulnerability

• CWE-150

<1.5.2 · fixed in 1.5.2

Jinja has a sandbox breakout through malicious filenames

• CWE-150

>=3.0.0, <3.1.5 · fixed in 3.1.5

gitoxide-core does not neutralize special characters for terminals

• CWE-150

>=0.0.0-0 · no fixed version yet

Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints in github.com/mutagen-io/mutagen

• CWE-150

<0.16.6 || >=0.17.0, <0.17.1 · fixed in 0.16.6, 0.17.1

RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-2024-33899.

• CWE-150

Arbitrary code execution due to improper sanitization of web app properties in PWAsForFirefox

• filips123 PWAsForFirefox
• Other injection
• CWE-150

RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.

• CWE-150

wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv.

• CWE-150

Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI stripping

• CWE-150

>=1.32.1, <1.41.0 · fixed in 1.41.0

Shescape on Windows escaping may be bypassed in threaded context

• CWE-150

<1.7.4 · fixed in 1.7.4

CyberPower PowerPanel Enterprise: An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to…

• CyberPower PowerPanel Enterprise
• CWE-150

Dangerzone CLI does not sanitize ANSI escape characters

• freedomofpress dangerzone
• CWE-150

Interactive `run` permission prompt spoofing via improper ANSI neutralization

• CWE-150

>=1.8.0, <1.31.2 · fixed in 1.31.2

XWiki Platform may allow privilege escalation to programming rights via user's first name

• CWE-150

>=3.1-milestone-1, <13.10.9 || >=14.0-rc-1, <14.4.4 || >=14.5, <14.7-rc-1 · fixed in 13.10.9, 14.4.4, 14.7-rc-1

Possible shell escape sequence injection vulnerability in Rack

• CWE-150

<2.0.9.1 || >=2.1, <2.1.4.1 || >=2.2, <2.2.3.1 · fixed in 2.0.9.1, 2.1.4.1, 2.2.3.1

RubyGems Code Injection vulnerability

• Code injection
• CWE-150

<2.6.13 · fixed in 2.6.13

kubectl ANSI escape characters not filtered

• CWE-150

<1.26.0-alpha.3 · fixed in 1.26.0-alpha.3

Control character injection in console output in github.com/ipfs/go-ipfs

• CWE-116
• CWE-150

<0.8.0 · fixed in 0.8.0

The administration web interface on Belkin Linksys WRT160NL 1.0.04.002_US_20130619 devices allows remote authenticated attackers to execute system commands with root privileges via shell metacharacte…

• CWE-150

An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Software Development Platform versions 6.4.0 to 6.6.0 could allow an attacker to pote…

• BlackBerry QNX Software Development Platform (SDP)
• CWE-150