共收录 47 条相关情报。
← 返回所有主题CVE-2026-118994
CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the logi
CVE-2026-109786
In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on " suffix aft
CVE-2026-109786
In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on " suffix aft
CVE-2026-41504
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native
CVE-2026-41504
## Root Cause File: `internal/auditlog/formats.go` — multiple sites write attacker-influenced bytes into the Native aud
CVE-2026-87859
### Impact Morgan writes attacker-controlled request data to the access log. Its escaping (added in 1.11.0 and 1.12.0)
CVE-2026-93421
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /_
CVE-2026-93421
### Summary The `/__csp__` endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to st
CVE-2026-93421
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /_
CVE-2026-6327
IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutra
CVE-2026-11538
IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token coo
CVE-2026-86522
Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attack
CVE-2026-84501
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a cra
CVE-2026-84439
When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields int
CVE-2026-16189
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server
CVE-2026-87859
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does n
CVE-2026-15603
### Impact Morgan writes attacker-controlled request data to the access log through its tokens. The 1.11.0 fix neutrali
CVE-2026-14350
IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to inject data into log
CVE-2026-9736
IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages
CVE-2026-9736
IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages