CWE-838.

MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing

• CWE-838

>=3.0.0, <3.3.7 || >=3.4.0, <3.4.5 || >=3.5.0, <3.5.11 · fixed in 3.3.7, 3.4.5, 3.5.11

Plaintext exposure of encrypted fields via ANSI code-page corruption of database name

• MongoDB C# Driver
• MongoDB.Libmongocrypt NuGet package
• CWE-838

Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute

• zammad
• Cross-site scripting (XSS)
• Cross-site request forgery (CSRF)

org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output

• CWE-116
• CWE-838

<1.4.1 · fixed in 1.4.1

org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context

• CWE-838

<2.7.14 || >=3.0.0, <3.3.5 || >=3.4.0, <3.4.3 || >=3.5.0, <3.5.9 · fixed in 2.7.14, 3.3.5, 3.4.3, 3.5.9

Round-trip Corruption via Improper Entity Escaping in xml_builder

• CWE-838

>=0.0.6, <2.4.1 · fixed in 2.4.1

FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal

• FOSSBilling
• Cross-site scripting (XSS)
• CWE-838

Google Chrome: Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed…

• Google Chrome
• CWE-838

Mozilla Firefox: Copying sensitive information from Private Browsing tabs on Android, such as passwords…

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-838

Moodle Unsanitized HTML in site log for config_log_created

• CWE-838

<4.1.10 || >=4.2.0, <4.2.7 || >=4.3.0, <4.3.4 · fixed in 4.1.10, 4.2.7, 4.3.4

HTML injection in email body through email subject

• Proofpoint Enterprise Protection
• CWE-838

Google Chrome: Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62…

• Google Chrome
• CWE-838

Google Chrome: Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to…

• Google Chrome
• CWE-838

CSRF protection for any URL can be bypassed in Jenkins Pipeline: Input Step Plugin

• Cross-site request forgery (CSRF)
• CWE-838

<456.vd8a_957db_5b_e9 · fixed in 456.vd8a_957db_5b_e9

Jenkins Pipeline: Stage View Plugin allows CSRF protection bypass of any target URL in Jenkins

• Cross-site request forgery (CSRF)
• CWE-838

>=2.25, <2.27 || <2.24.2 · fixed in 2.27, 2.24.2

Pimcore Access Control Issues

• CWE-838

<6.2.2 · fixed in 6.2.2

Web Gateway (MWG) - Inappropriate Encoding for output context

• McAfee Web Gateway (MWG)
• CWE-838

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI c…

• CWE-838