#cwe-176

共收录 26 条相关情报。

漏洞预警2026-10-29 发布INFO

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/decode`, also used by `@sd-jwt/core`, si...

CVE-2026-62374

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and e

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-176 #cwe-754

漏洞预警2026-10-26 发布MEDIUM

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decod...

CVE-2026-116542

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthentica

来源摘录 · NVD

#cve #cwe-176

安全公告2026-10-21 发布INFO

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line...

CVE-2026-114114

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-176 #severity:medium

漏洞预警2026-10-21 发布MEDIUM

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-by...

CVE-2026-114114

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8

来源摘录 · NVD

#cve #cwe-176

漏洞预警2026-10-19 发布HIGH

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. canonical sorts keys by UTF-16 code units. When any k...

CVE-2026-110687

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cm

来源摘录 · NVD

#cve #cwe-176

漏洞预警2026-10-19 发布MEDIUM

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. With allow_barekey,...

CVE-2026-110674

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion und

来源摘录 · NVD

#cve #cwe-176 #cwe-843

漏洞预警2026-10-06 发布INFO

Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the mail file writer cannot encode, such as an unpaired UTF-16 ...

CVE-2026-105241

Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the ma

历史摘要 · 未重新核验 · NVD

#cve #cwe-176

漏洞预警2026-10-05 发布INFO

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. pwhois encodes each non-ASCII...

CVE-2026-19954

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain

历史摘要 · 未重新核验 · NVD

#cve #cwe-176

漏洞预警2026-09-30 发布INFO

An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications ...

CVE-2026-86105

An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privil

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-176 #cwe-285

安全公告2026-09-20 发布INFO

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input,...

CVE-2026-93990

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-1

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-176 #severity:high

漏洞预警2026-09-19 发布HIGH

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 en...

CVE-2026-93990

CVE-2026-93990 是 Expat XML 解析库（2.8.4 及之前版本）中的一个安全缺陷。问题出在 UTF-16 解码过程中，解析器未能正确验证高代理项（high surrogate）之后必须跟随低代理项（low surrog

历史摘要 · 未重新核验 · NVD

#cve #cwe-176

漏洞预警2026-09-18 发布INFO

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. At...

CVE-2026-93751

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlon

历史摘要 · 未重新核验 · NVD

#cve #cwe-176

漏洞预警2026-09-16 发布INFO

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueL...

CVE-2026-81869

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attr

历史摘要 · 未重新核验 · NVD

#cve #cwe-176 #cwe-400

漏洞预警2026-08-19 发布INFO

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due ...

CVE-2026-14978

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sens

历史摘要 · 未重新核验 · NVD

#cve #cwe-176

漏洞预警2026-07-08 发布INFO

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-excl...

CVE-2026-59890

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to

历史摘要 · 未重新核验 · NVD

#cve #cwe-176 #cwe-697

安全公告2026-07-08 发布INFO

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

CVE-2026-59890

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-176 #cwe-697

安全公告2026-07-06 发布INFO

ln: rejects non-UTF-8 source filenames in target-directory mode

CVE-2026-35373

In target-directory forms (`ln SOURCE... DIRECTORY`), `ln` rejects source paths with non-UTF-8 filename bytes, while GNU

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #rust #cwe-176 #severity:low

安全公告2026-07-06 发布INFO

comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output

CVE-2026-35346

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. Th

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #rust #cwe-116 #cwe-176 #severity:low

安全公告2026-06-26 发布INFO

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead...

CVE-2026-48618

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-176 #severity:high

漏洞预警2026-06-26 发布INFO

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostna...

CVE-2026-48618

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth

历史摘要 · 未重新核验 · NVD

#cve #cwe-176