Weakness (CWE)
CWE-652: Improper Neutralization of Data within XQuery Expressions
The product uses external input to dynamically construct an XQuery expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input.
How to prevent it (2 mitigations)
-
Implementation
Use parameterized queries. This will help ensure separation between data plane and control plane.
-
Implementation
Properly validate user input. Reject data where appropriate, filter where appropriate and escape where appropriate. Make sure input that will be used in XQL queries is safe in that context.
Source: MITRE CWE-652
2 results · Feed
-
High 8.8
Jenkins Convert To Pipeline Plugin vulnerable to cross-site request forgery
A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a Pipeline based on a Freestyle project, potentially leading to remote code execution (RCE).
-
Medium 6.5
Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2
Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.