| Using UTF-8 Encoding to Bypass Validation Logic |
|
CWE-20
|
Improper Input Validation
|
|
CWE-21
|
|
|
CWE-73
|
External Control of File Name or Path
|
|
CWE-74
|
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
|
|
CWE-171
|
|
|
CWE-172
|
Encoding Error
|
|
CWE-173
|
Improper Handling of Alternate Encoding
|
|
CWE-180
|
Incorrect Behavior Order: Validate Before Canonicalize
|
|
CWE-181
|
Incorrect Behavior Order: Validate Before Filter
|
|
CWE-692
|
Incomplete Denylist to Cross-Site Scripting
|
|
CWE-697
|
Incorrect Comparison
|
|
| AJAX Footprinting |
|
CWE-20
|
Improper Input Validation
|
|
CWE-79
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
|
|
CWE-86
|
Improper Neutralization of Invalid Characters in Identifiers in Web Pages
|
|
CWE-96
|
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
|
|
CWE-113
|
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
|
|
CWE-116
|
Improper Encoding or Escaping of Output
|
|
CWE-184
|
Incomplete List of Disallowed Inputs
|
|
CWE-348
|
Use of Less Trusted Source
|
|
CWE-692
|
Incomplete Denylist to Cross-Site Scripting
|
|
CWE-712
|
OWASP Top Ten 2007 Category A1 - Cross Site Scripting (XSS)
|
|
| Leverage Alternate Encoding |
|
CWE-20
|
Improper Input Validation
|
|
CWE-21
|
|
|
CWE-73
|
External Control of File Name or Path
|
|
CWE-74
|
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
|
|
CWE-171
|
|
|
CWE-172
|
Encoding Error
|
|
CWE-173
|
Improper Handling of Alternate Encoding
|
|
CWE-180
|
Incorrect Behavior Order: Validate Before Canonicalize
|
|
CWE-181
|
Incorrect Behavior Order: Validate Before Filter
|
|
CWE-692
|
Incomplete Denylist to Cross-Site Scripting
|
|
CWE-697
|
Incorrect Comparison
|
|
| Double Encoding |
|
CWE-20
|
Improper Input Validation
|
|
CWE-21
|
|
|
CWE-74
|
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
|
|
CWE-171
|
|
|
CWE-172
|
Encoding Error
|
|
CWE-173
|
Improper Handling of Alternate Encoding
|
|
CWE-177
|
Improper Handling of URL Encoding (Hex Encoding)
|
|
CWE-181
|
Incorrect Behavior Order: Validate Before Filter
|
|
CWE-183
|
Permissive List of Allowed Inputs
|
|
CWE-184
|
Incomplete List of Disallowed Inputs
|
|
CWE-692
|
Incomplete Denylist to Cross-Site Scripting
|
|
CWE-697
|
Incorrect Comparison
|
|
| Using Unicode Encoding to Bypass Validation Logic |
|
CWE-20
|
Improper Input Validation
|
|
CWE-74
|
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
|
|
CWE-171
|
|
|
CWE-172
|
Encoding Error
|
|
CWE-173
|
Improper Handling of Alternate Encoding
|
|
CWE-176
|
Improper Handling of Unicode Encoding
|
|
CWE-179
|
Incorrect Behavior Order: Early Validation
|
|
CWE-180
|
Incorrect Behavior Order: Validate Before Canonicalize
|
|
CWE-183
|
Permissive List of Allowed Inputs
|
|
CWE-184
|
Incomplete List of Disallowed Inputs
|
|
CWE-692
|
Incomplete Denylist to Cross-Site Scripting
|
|
CWE-697
|
Incorrect Comparison
|
|