#cwe-116

共收录 223 条相关情报。

← 返回所有主题

漏洞预警2026-08-21 发布INFO

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to ...

CVE-2026-63466

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/

历史摘要 · 未重新核验 · NVD

安全公告2026-08-21 发布INFO

Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

CVE-2026-63466

## Vulnerability Details **File**: `src/lib/addons/feature-event-formatter-md.ts` **Line**: 355 (in v8.0.1; `format()`

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-116 #severity:medium

漏洞预警2026-08-21 发布INFO

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality. This issue affects Apache CloudStack: from 4.20.0.0 through...

CVE-2026-61399

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality. Th

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-21 发布INFO

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality. This issue affects Apache CloudStack: from 4....

CVE-2026-61398

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password func

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-19 发布INFO

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass security authentication due to improperly e...

CVE-2025-36254

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an attac

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-19 发布INFO

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a schema default is...

CVE-2026-72717

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-116 #cwe-1336

漏洞预警2026-08-19 发布INFO

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a header parameter ...

CVE-2026-71871

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-116 #cwe-1336

漏洞预警2026-08-19 发布INFO

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an array item defau...

CVE-2026-71869

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-116 #cwe-1336

漏洞预警2026-08-19 发布INFO

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted in...

CVE-2026-71865

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-95 #cwe-116

漏洞预警2026-08-19 发布INFO

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted i...

CVE-2026-71864

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-95 #cwe-116

漏洞预警2026-08-19 发布INFO

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted int...

CVE-2026-62682

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-116 #cwe-1336

漏洞预警2026-08-19 发布INFO

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted in...

CVE-2026-62681

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-116 #cwe-1336

安全公告2026-08-18 发布INFO

jmespath.php has CompilerRuntime code injection via unescaped function names

CVE-2026-54133

## Impact `mtdowling/jmespath.php` can generate and execute attacker-controlled PHP code when `JmesPath\CompilerRuntime

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-20 #cwe-94 #cwe-116 #severity:critical

漏洞预警2026-08-18 发布INFO

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback_message[...

CVE-2026-61696

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-79 #cwe-116

漏洞预警2026-08-18 发布INFO

Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cow_link:link/1. cow_link:d...

CVE-2026-43971

Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via une

历史摘要 · 未重新核验 · NVD

安全公告2026-08-16 发布INFO

Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in...

CVE-2026-73055

Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-116 #severity:critical

漏洞预警2026-08-15 发布MEDIUM

Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on Unix systems where the shell is explicitly configured to ...

CVE-2026-73055

该漏洞存在于 Shescape 库中，一个用于安全转义 shell 命令参数的 JavaScript 工具。在特定 Unix 环境下，即 /bin/sh 指向 BusyBox 且 shell 显式配置为 'sh' 或 'true' 时，Sh

历史摘要 · 未重新核验 · NVD

安全公告2026-08-14 发布INFO

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting...

CVE-2026-73479

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attac

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-116 #severity:medium

漏洞预警2026-08-13 发布INFO

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape seque...

CVE-2026-73479

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attac

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-13 发布INFO

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab all...

CVE-2026-73417

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-116