Filtered by vendor Ithewei Subscriptions
Filtered by product Libhv Subscriptions
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-26148 1 Ithewei 1 Libhv 2023-11-07 5.3 Medium
All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attacker can add the \r\n (carriage return line feeds) characters and inject additional headers in the request sent.
CVE-2023-26147 1 Ithewei 1 Libhv 2023-11-07 6.1 Medium
All versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to build headers values. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content, like for example additional headers or new response body, leading to a potential XSS vulnerability.
CVE-2023-26146 1 Ithewei 1 Libhv 2023-11-07 6.1 Medium
All versions of the package ithewei/libhv are vulnerable to Cross-site Scripting (XSS) such that when a file with a name containing a malicious payload is served by the application, the filename is displayed without proper sanitization when it is rendered.