2026-10-10 归档

今日共收录 1383 条安全情报，包含 534 个 CVE，469 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-08 发布INFO

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory.

CVE-2026-82900

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper li

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-08 发布INFO

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

CVE-2026-82895

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffe

历史摘要 · 未重新核验 · NVD

#cve #cwe-120

漏洞预警2026-10-08 发布INFO

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allo...

CVE-2026-81932

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker coul

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-08 发布INFO

Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSR...

CVE-2026-107831

Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-c

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-10-08 发布INFO

Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sen...

CVE-2026-107830

Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction en

历史摘要 · 未重新核验 · NVD

#cve #cwe-799

漏洞预警2026-10-08 发布INFO

Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash() in AccountDaoSql. Attackers who ob...

CVE-2026-107829

Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digest

历史摘要 · 未重新核验 · NVD

#cve #cwe-916

漏洞预警2026-10-08 发布INFO

Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Weibo-created accounts by deriving predictable credentials f...

CVE-2026-107828

Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Wei

历史摘要 · 未重新核验 · NVD

#cve #cwe-1391

漏洞预警2026-10-08 发布INFO

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments with an attacker-sup...

CVE-2026-107801

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-08 发布INFO

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages because receiveshortme...

CVE-2026-107800

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-08 发布INFO

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Messa...

CVE-2026-107799

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-08 发布INFO

jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs ...

CVE-2026-107798

jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the defaul

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-08 发布INFO

Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag para...

CVE-2026-107797

Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-08 发布INFO

Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in application/query/taggedThreadList.jsp that allows unauthenticat...

CVE-2026-107796

Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in applica

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-08 发布INFO

Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to delete other users' subscript...

CVE-2026-107793

Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that al

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-08 发布INFO

Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other u...

CVE-2026-107792

Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToFo

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-08 发布INFO

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a m...

CVE-2026-107726

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.1

历史摘要 · 未重新核验 · NVD

#cve #cwe-20

漏洞预警2026-10-08 发布INFO

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Pr...

CVE-2026-107725

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.1

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-10-08 发布INFO

fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js perfor...

CVE-2026-107724

fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-10-08 发布INFO

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance because its option validation checks type...

CVE-2026-107721

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for

历史摘要 · 未重新核验 · NVD

#cve #cwe-613 #cwe-682

漏洞预警2026-10-08 发布INFO

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is...

CVE-2026-107720

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-347