#cwe-15

共收录 33 条相关情报。

漏洞预警2026-07-31 发布INFO

HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or appl...

CVE-2026-56567

HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of intern

历史摘要 · 未重新核验 · NVD

#cve #cwe-15

漏洞预警2026-07-15 发布INFO

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to th...

CVE-2026-46485

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated user

历史摘要 · 未重新核验 · NVD

#cve #cwe-15 #cwe-284 #cwe-287 #cwe-602

安全公告2026-07-15 发布INFO

Dash: Users can write to config despire permissions (OIDC tested)

CVE-2026-46485

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated user

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-15 #cwe-284 #cwe-287 #cwe-602

安全公告2026-07-14 发布INFO

SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of...

CVE-2026-44768

SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-15 #severity:medium

漏洞预警2026-07-14 发布MEDIUM

SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy (CSP) configura...

CVE-2026-44768

该漏洞存在于 SAP CRM WebClient UI 中，由于未针对某些限制性指令配置内容安全策略（CSP），攻击者能够向应用程序注入并执行恶意脚本。这是一种跨站脚本（XSS）漏洞，攻击者需要拥有低权限并诱导用户执行交互操作（例如点击链接

历史摘要 · 未重新核验 · NVD

#cve #cwe-15

漏洞预警2026-06-09 发布INFO

Insufficient configuration management in the listed devices allows authenticated administrators connected to the local network to tamper with the system.

CVE-2026-0418

Insufficient configuration management in the listed devices allows authenticated administrators connected to the local n

历史摘要 · 未重新核验 · NVD

#cve #cwe-15

漏洞预警2026-06-05 发布INFO

HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vulnerability. An att...

CVE-2026-46399

HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-15 #cwe-73 #cwe-78

漏洞预警2026-06-02 发布INFO

The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza i...

CVE-2026-1784

The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found

历史摘要 · 未重新核验 · NVD

#cve #cwe-15

漏洞预警2026-06-01 发布INFO

Dräger Infinity Delta, Delta XL, and Kappa patient monitors contain a denial-of-service vulnerability that allows remote attackers to cause the monitor to reboot by sending a ma...

CVE-2019-25716

Dräger Infinity Delta, Delta XL, and Kappa patient monitors contain a denial-of-service vulnerability that allows remote

历史摘要 · 未重新核验 · NVD

#cve #cwe-15

漏洞预警2026-05-27 发布INFO

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server), the server binds...

CVE-2026-45087

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started

历史摘要 · 未重新核验 · NVD

#cve #cwe-15 #cwe-78 #cwe-306

安全公告2026-05-12 发布INFO

Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`

CVE-2026-45087

# GHSA: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode ## Summary When dalfox is start

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-15 #cwe-78 #cwe-306 #severity:critical

漏洞预警2026-05-11 发布INFO

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to before Core 6.4.2 and FTL 6.6.1, two shell scripts...

CVE-2026-41489

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From

历史摘要 · 未重新核验 · NVD

#cve #cwe-15 #cwe-269 #cwe-732

漏洞预警2026-05-05 发布INFO

OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables. Attackers can inject ...

CVE-2026-43531

OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env file

历史摘要 · 未重新核验 · NVD

#cve #cwe-15