#cwe-88

共收录 215 条相关情报。

← 返回所有主题
漏洞预警2026-09-23 发布INFO

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that begin with a dash and is stored ...

CVE-2026-84502

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not valid

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-23 发布INFO

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute a...

CVE-2026-75131

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local use

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-23 发布INFO

RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit b...

CVE-2026-71465

RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-23 发布INFO

LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Sched...

CVE-2026-71464

LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike

历史摘要 · 未重新核验 · NVD

安全公告2026-09-23 发布INFO

NetworkManager-l2tp Privilege Escalation via pppd Username Injection

CVE-2026-75131

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local use

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-21 发布INFO

In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied input passe...

CVE-2026-94588

In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-18 发布INFO

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administrative command, caus...

CVE-2026-28197

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially cr

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through Webrecorder's hosted instance. From 1.15.0 until 1.22.8,...

CVE-2026-54501

Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

NetworkManager-l2tp contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by s...

CVE-2026-93337

NetworkManager-l2tp contains an improper input validation vulnerability that allows local users with VPN connection crea

历史摘要 · 未重新核验 · NVD

安全公告2026-09-17 发布INFO

NetworkManager-l2tp Privilege Escalation via pppd Plugin Injection

CVE-2026-93337

NetworkManager-l2tp contains an improper input validation vulnerability that allows local users with VPN connection crea

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-17 发布INFO

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with strings.Spl...

CVE-2026-55061

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget

历史摘要 · 未重新核验 · NVD

安全公告2026-09-17 发布INFO

uniget: EDITOR Command Injection in uniget CLI

CVE-2026-55061

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-17 发布INFO

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands ...

CVE-2026-89036

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the pg_dump argument vector as a bare trailing positional argu...

CVE-2026-86864

pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job//object request to the pg_dum

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pg_restore and psql. libpq expands a ...

CVE-2026-86862

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbn

历史摘要 · 未重新核验 · NVD

安全公告2026-09-16 发布INFO

Netcore NR255-V version 1.5.130703 contains an os command argument injection vulnerability in the...

CVE-2026-76862

Netcore NR255-V version 1.5.130703 contains an os command argument injection vulnerability in the Nettools tcpdump launc

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-09-16 发布INFO

Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user...

CVE-2026-76866

Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNS

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-15 发布INFO

Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNSset_cgi.c and related ddns_Proc.c components, enabling os...

CVE-2026-76866

Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNS

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-15 发布INFO

Netcore NR255-V version 1.5.130703 contains an os command argument injection vulnerability in the Nettools tcpdump launch paths, including ntools_start_set_cgi, ntools_tcpdump_s...

CVE-2026-76862

Netcore NR255-V version 1.5.130703 contains an os command argument injection vulnerability in the Nettools tcpdump launc

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-15 发布INFO

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video upload function allows unauthenticated attacker to write/ov...

CVE-2026-54337

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video up

历史摘要 · 未重新核验 · NVD