123 matches found
CVE-2025-59476
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may...
CVE-2025-59476
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may...
CVE-2025-59476
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may...
CVE-2025-59476
Summary: CVE-2025-59476 affects Jenkins 2.527 and earlier, and LTS 2.516.2 and earlier. The issue is that the log formatter does not restrict or transform characters in user-supplied log content, enabling an attacker to insert line breaks and forge subsequent log messages, potentially misleading ...
CVE-2025-59476
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may...
CVE-2025-59476
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may...
PT-2025-38153
Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.527 and earlier Jenkins LTS versions 2.516.2 and earlier Description: Jenkins does not restrict or transform characters inserted from user-specified content in log messages. This allows attackers who can control log message...
Amazon Linux 2023 : python3-h2 (ALAS2023-2025-1181)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1181 advisory. h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF...
PostgreSQL 安全漏洞
PostgreSQL is a free object-relational database management system from the PostgreSQL organization. The system supports most of the SQL standards and provides many other features such as foreign keys, triggers, views, and more. A security vulnerability exists in PostgreSQL versions 17.6, 16.10,...
CVE-2025-54377
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.23.18 and below, RooCode does not validate line breaks \n in its command input, allowing potential bypass of the allow-list mechanism. The project appears to lack parsing or validation logic to prevent...
Rack 安全漏洞
Rack is a modular Ruby web server interface open-sourced by Rack. Rack has a security vulnerability that originates from the ability to manipulate log entries by crafting input that contains line breaks to utilize Rack::CommonLogger...
USN-7191-1 firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. CVE-2025-0237, CVE-2025-0239,...
GHSA-59G5-XGCQ-4QW3 Denial of service (DoS) via deformation `multipart/form-data` boundary
Summary When parsing form data, python-multipart skips line breaks CR \r or LF \n in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs. An attacker could...
Allocation of Resources Without Limits or Throttling
Overview python-multipart is an A streaming multipart parser for Python Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the multipart/form-data, when line breaks: CR \r or LF \n in front of the first boundary and any tailing bytes...
DEBIAN-CVE-2024-53981
python-multipart is a streaming multipart parser for Python. When parsing form data, python-multipart skips line breaks CR \r or LF \n in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause...
Python 安全漏洞
Python is an open source, object-oriented programming language from the Python Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. A security vulnerability exists in Python that stems from a failure of the email module to properly reference line...
Matrix matrix-appservice-irc Command Injection Vulnerability
matrix-appservice-irc is a bridge for Matrix. This bridge passes all IRC messages to Matrix and all Matrix messages to IRC. A command injection vulnerability exists in Matrix matrix-appservice-irc versions prior to 1.0.1, which stems from a vulnerability that allows an attacker to craft commands...
PSR-7 Message Implementation 安全漏洞
PSR-7 Message Implementation is a complete PSR-7 message implementation. A security vulnerability exists in PSR-7 Message Implementation that stems from an incorrect header parsing issue, which can be exploited by an attacker to include line breaks in header names and values...
SUSE CVE-2015-5234
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks...