#cwe-625

共收录 18 条相关情报。

← 返回所有主题

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator() is documented to anchor the supplied patte...

CVE-2026-118995

CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. creat

来源摘录 · NVD

#cve #cwe-625

安全公告2026-10-13 发布INFO

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before...

CVE-2026-14814

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-625 #severity:high

漏洞预警2026-10-13 发布INFO

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowe...

CVE-2026-14814

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before

历史摘要 · 未重新核验 · NVD

#cve #cwe-625

安全公告2026-10-01 发布INFO

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

CVE-2026-102830

## Description A language pack ships a `Plural-Forms` header saying how the language counts, for example `nplurals=2; p

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-79 #cwe-94 #cwe-625 #severity:medium

安全公告2026-09-08 发布INFO

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

CVE-2026-83617

## Summary An embedded line terminator bypasses the `requireWellFormed` serializer check for element and attribute name

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-91 #cwe-625 #severity:high

漏洞预警2026-09-01 发布INFO

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer valida...

CVE-2026-83618

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.10 un

历史摘要 · 未重新核验 · NVD

#cve #cwe-91 #cwe-625

漏洞预警2026-09-01 发布INFO

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attri...

CVE-2026-83617

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 un

历史摘要 · 未重新核验 · NVD

#cve #cwe-91 #cwe-625

漏洞预警2026-09-01 发布INFO

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js com...

CVE-2026-83609

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 unt

历史摘要 · 未重新核验 · NVD

#cve #cwe-91 #cwe-625

安全公告2026-09-01 发布INFO

xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

CVE-2026-83618

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.10 un

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-625 #cwe-91

安全公告2026-09-01 发布INFO

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

CVE-2026-83617

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 un

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-625 #cwe-91

安全公告2026-09-01 发布INFO

xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

CVE-2026-83609

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 unt

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-625 #cwe-91

漏洞预警2026-08-31 发布INFO

Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a craft...

CVE-2026-82726

Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash app

历史摘要 · 未重新核验 · NVD

#cve #cwe-178 #cwe-625

安全公告2026-08-31 发布INFO

AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

CVE-2026-82726

Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash app

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-178 #cwe-625

漏洞预警2026-08-25 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome extension origins with re.match() and the unanchored expres...

CVE-2026-55536

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome ex

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-625

漏洞预警2026-08-14 发布INFO

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/quality.ts use isVa...

CVE-2026-73845

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_m

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-625 #cwe-918

漏洞预警2026-08-10 发布INFO

A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular...

CVE-2026-19278

A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configu

历史摘要 · 未重新核验 · NVD

#cve #cwe-625

漏洞预警2026-08-10 发布INFO

Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the a...

CVE-2026-64940

Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular exp

历史摘要 · 未重新核验 · NVD

#cve #cwe-625

漏洞预警2026-06-05 发布INFO

sanic-cors version 2.2.0 and prior contains an improper regular expression in the try_match() function in sanic_cors/core.py that uses re.match without end-anchoring. This allow...

CVE-2026-37737

sanic-cors version 2.2.0 and prior contains an improper regular expression in the try_match() function in sanic_cors/cor

历史摘要 · 未重新核验 · NVD

#cve #cwe-346 #cwe-625