#cwe-93

共收录 163 条相关情报。

← 返回所有主题

漏洞预警2026-09-03 发布INFO

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity,...

CVE-2026-84962

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

漏洞预警2026-09-02 发布INFO

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attacker-controlled cont...

CVE-2026-84379

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_mu

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

安全公告2026-09-02 发布INFO

HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

CVE-2026-84379

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_mu

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-93

漏洞预警2026-09-01 发布INFO

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication con...

CVE-2026-84372

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, p

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

安全公告2026-09-01 发布INFO

Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

CVE-2026-84372

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, p

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-93

漏洞预警2026-08-31 发布CRITICAL

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size ...

CVE-2026-82854

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an

来源摘录 · NVD

#cve #cwe-93

漏洞预警2026-08-31 发布INFO

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated dire...

CVE-2026-82853

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EH

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

漏洞预警2026-08-31 发布INFO

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker wi...

CVE-2026-82661

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing atta

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

安全公告2026-08-31 发布INFO

Nodemailer before 8.0.3 SMTP Command Injection via envelope.size

CVE-2026-82854

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-93

安全公告2026-08-31 发布INFO

Nodemailer before 8.0.5 SMTP Command Injection via CRLF

CVE-2026-82853

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EH

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-93

安全公告2026-08-31 发布INFO

Nodemailer CRLF Injection via List-* Header Comments

CVE-2026-82661

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing atta

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-93

漏洞预警2026-08-28 发布INFO

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example du...

CVE-2026-33606

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

漏洞预警2026-08-28 发布INFO

cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket wi...

CVE-2026-77341

cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes

历史摘要 · 未重新核验 · NVD

#cve #cwe-93 #cwe-113

安全公告2026-08-27 发布INFO

cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing

CVE-2026-77341

cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-113 #cwe-93

漏洞预警2026-08-27 发布INFO

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 - 7.0.8 Spring Framewo...

CVE-2026-59313

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Ev

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

漏洞预警2026-08-27 发布INFO

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework ...

CVE-2026-47890

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fr

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

安全公告2026-08-26 发布INFO

@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

CVE-2026-54511

`@logtape/syslog` contains two related output-encoding bugs in the structured data formatting code. Both only affect dep

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-93 #cwe-117 #severity:high

漏洞预警2026-08-24 发布INFO

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Mes...

CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their res

历史摘要 · 未重新核验 · NVD

#cve #cwe-93

安全公告2026-08-23 发布INFO

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded...

CVE-2026-75922

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unenco

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-93

漏洞预警2026-08-23 发布INFO

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line. PSGI hands PATH_INFO t...

CVE-2026-75922

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unenco

历史摘要 · 未重新核验 · NVD

#cve #cwe-93 #cwe-444