#CVE

共收录 63078 条相关情报。

漏洞预警2026-10-27 发布INFO

The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's pass...

CVE-2026-107145

The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the l

来源摘录 · NVD

#cve #cwe-307

漏洞预警2026-10-27 发布INFO

Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and inv...

CVE-2026-102789

Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorCon

来源摘录 · NVD

#cve #cwe-284

漏洞预警2026-10-27 发布INFO

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a s...

CVE-2026-102788

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-27 发布INFO

Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5

CVE-2026-102787

Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5

来源摘录 · NVD

#cve #cwe-352

漏洞预警2026-10-27 发布INFO

The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership...

CVE-2026-92885

The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versi

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-27 发布MEDIUM

This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC

CVE-2026-65213

This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BM

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-27 发布HIGH

This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.

CVE-2026-65211

This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby exe

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-27 发布HIGH

A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.

CVE-2026-65220

A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-27 发布HIGH

A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be u...

CVE-2026-65219

A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP mess

来源摘录 · NVD

#cve #cwe-696

漏洞预警2026-10-27 发布MEDIUM

This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role.

CVE-2026-65210

This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing mat

来源摘录 · NVD

#cve #cwe-552

漏洞预警2026-10-27 发布LOW

The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take ...

CVE-2026-18451

The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation m

来源摘录 · NVD

#cve #cwe-337

漏洞预警2026-10-27 发布CRITICAL

The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active...

CVE-2026-18450

The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to c

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-27 发布HIGH

The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active...

CVE-2026-18449

The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to c

来源摘录 · NVD

#cve #cwe-798

漏洞预警2026-10-27 发布HIGH

An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command payload into a BMC function; the payload may execute when ...

CVE-2026-16521

An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command p

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-27 发布INFO

An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a remote attacker with the required pr...

CVE-2026-111461

An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabl

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-10-27 发布INFO

A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptograph...

CVE-2026-111460

A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauth

来源摘录 · NVD

#cve #cwe-321

漏洞预警2026-10-27 发布INFO

An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to t...

CVE-2026-111459

An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditi

来源摘录 · NVD

#cve #cwe-295

漏洞预警2026-10-27 发布MEDIUM

The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forget_password_link' parameter in all versions up to, and including, 4.61.0 due to...

CVE-2026-10511

The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forget_password_link' para

来源摘录 · NVD

#cve #cwe-80

漏洞预警2026-10-27 发布INFO

An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert te...

CVE-2026-107472

An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Q

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-27 发布INFO

An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords stored in or transmitted by GSS Deploym...

CVE-2026-101034

An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and

来源摘录 · NVD

#cve #cwe-522