Filtered by vendor Ithewei Subscriptions
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-26148 1 Ithewei 1 Libhv 2024-11-21 5.4 Medium
All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attacker can add the \r\n (carriage return line feeds) characters and inject additional headers in the request sent.
CVE-2023-26147 1 Ithewei 1 Libhv 2024-11-21 5.3 Medium
All versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to build headers values. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content, like for example additional headers or new response body, leading to a potential XSS vulnerability.
CVE-2023-26146 2 Ithewei, Ithewei\/libhv 2 Libhv, Ithewei\/libhv 2024-11-21 6.1 Medium
All versions of the package ithewei/libhv are vulnerable to Cross-site Scripting (XSS) such that when a file with a name containing a malicious payload is served by the application, the filename is displayed without proper sanitization when it is rendered.