Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Use of GLFortiGateSyslogEvent parser wrapper detected. This parser contains flawed field sanitization logic that deletes top-level syslog fields if embedded key-value pairs exist within field values, enabling log evasion and field tampering. Use the standard FortiGateSyslogEvent from syslog4j instead.
RFC 5424 structured data escaping only replaces backslashes, double quotes, and closing brackets, but does not sanitize C0 control characters (0x00-0x1F) such as newlines. In syslog framing (RFC 6587), unescaped newlines can terminate frames and allow log injection or frame forgery. Ensure all control characters are neutralized.
Filenames, optarg values, and similar string properties may contain control characters (like ANSI escape sequences). Printing them directly to standard output or log channels without sanitization exposes terminal emulators to injection attacks (CWE-150 / CWE-117). This allows an attacker to disguise or tamper with log contents. Always pass potentially untrus
Database-derived ID3 tag value (artist / album_artist / artist_sort / album_artist_sort / album / title / genre) is written into a newline-delimited MPD response via evbuffer_add_printf without sanitizing embedded newline characters. A media file with a crafted tag containing '\n' will inject extra MPD response lines and corrupt the line-based protocol frami
Detected the flawed sanitization regex `/[^[:print:]\n]/`. This pattern replaces non-printable characters but explicitly skips newline characters (`\n`), allowing them to bypass the filter. In contexts like logging (e.g., `Rack::CommonLogger`), this leads to Log Injection/CRLF injection (CWE-117) as unescaped newlines can be manipulated by attackers to embed
HTTP URL path or query string data is formatted with the '%s' verb, which does not escape newline characters. An attacker can inject arbitrary log entries by embedding newlines (CRLF) in a crafted request URL. Use '%#v' or '%q' as the format verb, or sanitize the value with strconv.Quote() before including it in log output.
