#cwe-200

共收录 1829 条相关情报。

漏洞预警2026-06-12 发布INFO

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-alpha.5, apps that enable MFA ...

CVE-2026-53725

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

安全公告2026-06-12 发布INFO

TYPO3 CMS has Broken Access Control in its Media Module

CVE-2026-49742

### Problem Backend users with file download permissions were able to download files from the fallback storage of the fi

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-22 #cwe-200 #severity:high

安全公告2026-06-12 发布INFO

TYPO3 CMS: Broken Access Control in Media Module

CVE-2026-47351

### Problem Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read p

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-200 #cwe-862 #severity:medium

漏洞预警2026-06-12 发布INFO

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to validate that a username returned during bot registration belongs to a b...

CVE-2026-6046

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to validate that a

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-06-12 发布INFO

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affec...

CVE-2026-3433

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_u

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-06-12 发布INFO

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the netw...

CVE-2026-50009

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final,

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-330

漏洞预警2026-06-12 发布INFO

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, DB Schema Enumeration is possible through exploiting an endpoint. This issue has been p...

CVE-2026-44206

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, DB Schema Enumeration is possi

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-06-12 发布INFO

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_con...

CVE-2026-45536

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Fina

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-772

漏洞预警2026-06-11 发布INFO

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, a user who can configure bot settings can set the ticket trans...

CVE-2026-47177

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, a use

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-06-11 发布INFO

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, a user who can configure bot settings can enable logging and c...

CVE-2026-47176

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, a use

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-06-11 发布INFO

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affe...

CVE-2026-44486

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapte

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

安全公告2026-06-11 发布INFO

Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

CVE-2026-48050

### Summary Arc registers Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/ap

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-200 #cwe-306 #cwe-400 #severity:high

安全公告2026-06-11 发布INFO

@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

CVE-2026-48022

### Impact Wreck strips credential headers (Authorization, Cookie, Proxy-Authorization) before following a cross-origin

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-200 #cwe-319 #cwe-346 #cwe-522

安全公告2026-06-11 发布INFO

Element Call reports full URLs of visited pages to analytics server

CVE-2026-48007

### Impact Element Call versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-200 #severity:high

漏洞预警2026-06-11 发布INFO

Cerebrate before version 1.37 exposed credential material from self-registration requests. The self-registration workflow stored the registrant’s hashed password in the inbox me...

CVE-2026-53912

Cerebrate before version 1.37 exposed credential material from self-registration requests. The self-registration workflo

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-06-10 发布INFO

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, an incorrect parsing of the filename can...

CVE-2026-49219

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-78 #cwe-200 #cwe-863

漏洞预警2026-06-10 发布INFO

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache was original...

CVE-2026-47165

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-06-10 发布INFO

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers in esp_secure_services.c and esp_secu...

CVE-2026-45329

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, several ESP-TEE secu

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-125 #cwe-200

漏洞预警2026-06-09 发布INFO

Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-50508

Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform sp

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-06-09 发布INFO

Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

CVE-2026-47284

Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disc

历史摘要 · 未重新核验 · NVD

#cve #cwe-200