CWE-644 对HTTP头部进行脚本语法转义处理不恰当 类弱点 55 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-644属于HTTP头注入漏洞，指产品未正确净化HTTP头中的脚本语法。攻击者常通过构造恶意HTTP头，利用浏览器组件（如Flash）执行跨站脚本攻击，窃取用户数据或劫持会话。开发者应避免将用户可控数据直接写入HTTP头，需对输入进行严格过滤与编码，确保特殊字符被正确转义，从而阻断恶意脚本的执行路径，保障应用安全。
response.addHeader(HEADER_NAME, untrustedRawInputData);| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-2950 | IBM i 安全漏洞 — i | 5.4 | Medium | 2025-04-18 |
| CVE-2022-43847 | IBM Aspera Console 安全漏洞 — Aspera Console | 5.4 | Medium | 2025-04-14 |
| CVE-2025-0154 | IBM TXSeries for Multiplatforms 安全漏洞 — TXSeries for Multiplatforms | 5.3 | Medium | 2025-04-02 |
| CVE-2025-27632 | Hitachi Energy TRMTracker 注入漏洞 — TRMTracker | 6.1 | Medium | 2025-03-25 |
| CVE-2023-35894 | IBM Control Center 安全漏洞 — Control Center | 5.4 | Medium | 2025-03-07 |
| CVE-2025-23191 | SAP Fiori 安全漏洞 — SAP Fiori for SAP ERP | 3.1 | Low | 2025-02-11 |
| CVE-2024-30129 | HCL Nomad 安全漏洞 — Nomad server on Domino | 5.3 | Medium | 2024-12-06 |
| CVE-2024-10006 | HashiCorp Consul 安全漏洞 — Consul | 8.3 | High | 2024-10-30 |
| CVE-2024-47549 | Sharp MFP 安全漏洞 — Sharp Digital Full-color MFPs and Monochrome MFPs | 7.4 | High | 2024-10-25 |
| CVE-2023-26289 | IBM Aspera Orchestrator 安全漏洞 — Aspera Orchestrator | 5.4 | Medium | 2024-07-30 |
| CVE-2024-39736 | IBM Datacap Navigator 安全漏洞 — Datacap Navigator | 6.5 | Medium | 2024-07-15 |
| CVE-2022-22399 | IBM Aspera 安全漏洞 — Aspera Faspex | 5.4 | Medium | 2024-03-05 |
| CVE-2024-21499 | caddy-security 安全漏洞 — github.com/greenpau/caddy-security | 4.3 | Medium | 2024-02-17 |
| CVE-2024-1064 | Crafty Controller 安全漏洞 — Crafty Controller | 7.5 | High | 2024-02-03 |
| CVE-2023-47143 | IBM Tivoli Application Dependency Discovery Manager 安全漏洞 — Tivoli Application Dependency Discovery Manager | 10.0 | Critical | 2024-02-02 |
| CVE-2023-34036 | Spring HATEOAS 安全漏洞 — Spring HATEOAS | 5.3 | Medium | 2023-07-17 |
| CVE-2023-36921 | SAP Solution Manager 安全漏洞 — SAP Solution Manager (Diagnostic Agent) | 7.2 | High | 2023-07-11 |
| CVE-2023-32465 | Dell PowerProtect Cyber Recovery 安全漏洞 — PowerProtect Cyber Recovery | 8.8 | High | 2023-06-14 |
| CVE-2022-45102 | Dell EMC Data Protection Central 安全漏洞 — Data Protection Central | 5.4 | Medium | 2023-02-01 |
| CVE-2021-38997 | IBM API Connect 安全漏洞 — API Connect | 5.4 | Medium | 2022-12-01 |
| CVE-2022-34316 | IBM CICS TX 安全漏洞 — CICS TX | 3.7 | Low | 2022-11-14 |
| CVE-2021-20784 | Voidtools Everything 安全漏洞 — Everything | 6.1 | - | 2021-07-14 |
| CVE-2021-21265 | October CMS 安全漏洞 — october | 6.8 | Medium | 2021-03-10 |
| CVE-2020-6982 | Honeywell WIN-PAK 安全漏洞 — Honeywell WIN-PAK 4.7.2, Web and prior versions | 9.8 | - | 2020-03-24 |
| CVE-2017-6031 | Certec EDV GmbH atvise scada 安全漏洞 — Certec EDV GmbH atvise scada | 8.3 | - | 2017-05-06 |
CWE-644（对HTTP头部进行脚本语法转义处理不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 55 条 CVE 漏洞。