CWE-151
Improper Neutralization of Comment Delimiters
2006-07-19
00h00 +00:00
00h00 +00:00
Notifikasi untuk CWE tertentu
Tetap terinformasi tentang perubahan untuk CWE tertentu.
Nama: Improper Neutralization of Comment Delimiters
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as comment delimiters when they are sent to a downstream component.
Informasi Umum
Mode Pengenalan
ImplementationPlatform yang Berlaku
Bahasa
Kelas: Not Language-Specific (Undetermined)Konsekuensi Umum
| Cakupan | Dampak | Kemungkinan |
|---|---|---|
| Integrity | Unexpected State |
Contoh yang Diamati
| Referensi | Deskripsi |
|---|---|
CVE-2002-0001 | Mail client command execution due to improperly terminated comment in address list. |
CVE-2004-0162 | MIE. RFC822 comment fields may be processed as other fields by clients. |
CVE-2004-1686 | Well-placed comment bypasses security warning. |
CVE-2005-1909 | Information hiding using a manipulation involving injection of comment code into product. Note: these vulnerabilities are likely vulnerable to more general XSS problems, although a regexp might allow ">!--" while denying most other tags. |
CVE-2005-1969 | Information hiding using a manipulation involving injection of comment code into product. Note: these vulnerabilities are likely vulnerable to more general XSS problems, although a regexp might allow "
|
