#CVE

共收录 65074 条相关情报。

漏洞预警2026-10-21 发布MEDIUM

Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/ba...

CVE-2026-114399

Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by s

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-21 发布MEDIUM

Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo,...

CVE-2026-114398

Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HT

来源摘录 · NVD

#cve #cwe-434

漏洞预警2026-10-21 发布HIGH

Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely...

CVE-2026-114397

Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unse

来源摘录 · NVD

#cve #cwe-1188

漏洞预警2026-10-21 发布HIGH

Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search param...

CVE-2026-114396

Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inje

来源摘录 · NVD

#cve #cwe-943

漏洞预警2026-10-21 发布MEDIUM

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CV...

CVE-2026-114395

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated user

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-21 发布MEDIUM

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owne...

CVE-2026-114394

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content at

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-21 发布MEDIUM

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and P...

CVE-2026-114393

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify ticke

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-21 发布MEDIUM

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attacker...

CVE-2026-114392

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets ou

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-21 发布MEDIUM

Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to mo...

CVE-2026-114388

Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in Gr

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-21 发布HIGH

A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by th...

CVE-2026-114243

A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183

来源摘录 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-21 发布HIGH

Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service ...

CVE-2026-81755

Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attac

来源摘录 · NVD

#cve #cwe-400

漏洞预警2026-10-21 发布HIGH

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to exhaust the memory of a server ...

CVE-2026-80463

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0) on all platforms a

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-21 发布HIGH

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0) on all platforms. A client that creates multiple streams ...

CVE-2026-79704

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0)

来源摘录 · NVD

#cve #cwe-125

漏洞预警2026-10-21 发布CRITICAL

Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to bypass server authentication and inject or delive...

CVE-2026-78334

Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) on all platforms allows a remote atta

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-21 发布HIGH

Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or ...

CVE-2026-78066

Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled inp

来源摘录 · NVD

#cve #cwe-770

漏洞预警2026-10-21 发布HIGH

Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated attacker to crash the server...

CVE-2026-78058

Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms all

来源摘录 · NVD

#cve #cwe-400 #cwe-476

漏洞预警2026-10-21 发布HIGH

A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to c...

CVE-2026-78048

A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version

来源摘录 · NVD

#cve #cwe-617

漏洞预警2026-10-21 发布HIGH

A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control m...

CVE-2026-74758

A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to cras

来源摘录 · NVD

#cve #cwe-416

漏洞预警2026-10-21 发布HIGH

An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing...

CVE-2026-74755

An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attacke

来源摘录 · NVD

#cve #cwe-191

漏洞预警2026-10-21 发布MEDIUM

Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the certificate to an expected DNS name or...

CVE-2026-66392

Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, b

来源摘录 · NVD

#cve #cwe-297