#cwe-200

共收录 1721 条相关情报。

漏洞预警2026-08-30 发布INFO

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone ...

CVE-2026-81322

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with acc

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

安全公告2026-08-30 发布INFO

Cloaked plaintext leaks through a non-sensitive action argument in AshCloak

CVE-2026-81322

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with acc

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200

安全公告2026-08-30 发布INFO

Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for...

CVE-2026-82657

Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-200 #severity:high

安全公告2026-08-30 发布INFO

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg...

CVE-2026-82651

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*pa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-200 #severity:medium

安全公告2026-08-30 发布INFO

A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an...

CVE-2026-82548

A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the compo

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-200 #severity:medium

漏洞预警2026-08-30 发布INFO

Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. Unauthenticated attackers can retrieve forum top...

CVE-2026-82657

Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-30 发布INFO

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/path and /repo/diff/path endpoints in kernel/server/serve....

CVE-2026-82651

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-30 发布INFO

A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the component InitialUEMessage Handler. This manipulation causes i...

CVE-2026-82548

A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the compo

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-284

安全公告2026-08-30 发布INFO

Linux Foundation Magma InitialUEMessage information disclosure

CVE-2026-82548

A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the compo

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-284

安全公告2026-08-30 发布INFO

Admidio before 5.0.12 Authentication Bypass via RSS feeds

CVE-2026-82657

Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200

安全公告2026-08-30 发布INFO

SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff

CVE-2026-82651

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*pa

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200

安全公告2026-08-29 发布INFO

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not...

CVE-2026-77007

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-200 #severity:high

漏洞预警2026-08-29 发布INFO

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenti...

CVE-2026-77007

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

安全公告2026-08-28 发布INFO

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail...

CVE-2026-82306

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfi

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-200 #severity:medium

漏洞预警2026-08-28 发布INFO

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attacke...

CVE-2026-82306

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfi

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-28 发布INFO

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superuser_validators to b...

CVE-2026-55485

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0,

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-269 #cwe-863

漏洞预警2026-08-28 发布INFO

WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration s...

CVE-2026-81732

WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoint

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-28 发布INFO

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network...

CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the confi

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-28 发布INFO

An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. ...

CVE-2026-42392

An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to b

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-08-28 发布INFO

When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in t...

CVE-2026-40203

When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes

历史摘要 · 未重新核验 · NVD

#cve #cwe-200