The software receives input from an upstream component, but it
does not neutralize or incorrectly neutralizes special elements that could be
interpreted as macro symbols when they are sent to a downstream
component.
The software receives input from an upstream component, but it
does not neutralize or incorrectly neutralizes special elements that could be
interpreted as substitution characters when they are sent to a downstream
component.
The software receives input from an upstream component, but it
does not neutralize or incorrectly neutralizes special elements that could be
interpreted as variable name delimiters when they are sent to a downstream
component.
The software receives input from an upstream component, but it
does not neutralize or incorrectly neutralizes special elements that could be
interpreted as wildcards or matching symbols when they are sent to a downstream
component.
The software receives input from an upstream component, but it
does not neutralize or incorrectly neutralizes special elements that could be
interpreted as whitespace when they are sent to a downstream
component.
The software does not properly handle the characters that are
used to mark the beginning and ending of a group of entities, such as
parentheses, brackets, and braces.
The software receives input from an upstream component, but it
does not neutralize or incorrectly neutralizes NUL characters or null bytes when
they are sent to a downstream component.
Weaknesses in this attack-focused category do not properly
filter and interpret special elements in user-controlled input which could cause
adverse effect on the software behavior and integrity.
The software receives input from an upstream component, but it
does not neutralize or incorrectly neutralizes leading special elements that
could be interpreted in unexpected ways when they are sent to a downstream
component.