#CVE

共收录 58490 条相关情报。

← 返回所有主题

漏洞预警2026-10-30 发布INFO

DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds. _normalize_leap_seconds crosses day boundaries one day at a time, so ...

CVE-2026-87768

DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds. _normalize_l

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-407

漏洞预警2026-10-30 发布INFO

An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belong...

CVE-2026-75882

An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with s

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-30 发布INFO

Rejected reason: Further research determined the issue is not a vulnerability.

CVE-2026-64860

Rejected reason: Further research determined the issue is not a vulnerability.

来源摘录 · NVD

#cve

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single f...

CVE-2026-13576

CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed wit

来源摘录 · NVD

#cve #cwe-759 #cwe-916

漏洞预警2026-10-30 发布INFO

Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another ...

CVE-2026-119038

Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布INFO

Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the...

CVE-2026-119037

Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or e

来源摘录 · NVD

#cve #cwe-347

漏洞预警2026-10-30 发布INFO

Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A webhook body with a top-leve...

CVE-2026-119036

Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig() returns the caller's whole cbuser...

CVE-2026-118996

CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserC

来源摘录 · NVD

#cve #cwe-212

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator() is documented to anchor the supplied patte...

CVE-2026-118995

CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. creat

来源摘录 · NVD

#cve #cwe-625

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the login name to the application log without escaping control ch...

CVE-2026-118994

CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the logi

来源摘录 · NVD

#cve #cwe-117

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before_dispatch h...

CVE-2026-118993

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expre

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-30 发布HIGH

CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. restoreConfigBlob() feeds the database dum...

CVE-2026-118992

CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configur

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key. getCrypt() pads the backup password with "x" characters and c...

CVE-2026-118991

CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key. getC

来源摘录 · NVD

#cve #cwe-916

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob() has the sqlite...

CVE-2026-118990

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when takin

来源摘录 · NVD

#cve #cwe-379 #cwe-59

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route. Every CallBackery application mounts its ...

CVE-2026-118988

CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in t

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-30 发布INFO

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the resu...

CVE-2026-116130

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-626

漏洞预警2026-10-30 发布INFO

Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies. The decoder adds each read to one buffer o...

CVE-2026-116128

Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked re

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-30 发布INFO

Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection. The request method is not...

CVE-2026-116127

Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persi

来源摘录 · NVD

#cve #cwe-444

漏洞预警2026-10-30 发布INFO

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a...

CVE-2026-115866

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding c

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-30 发布INFO

Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysre...

CVE-2026-115865

Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting me

来源摘录 · NVD

#cve #cwe-789