#cwe-269

共收录 812 条相关情报。

漏洞预警2026-08-14 发布INFO

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local access could potentiall...

CVE-2026-63700

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A l

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-08-14 发布INFO

In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. ...

CVE-2026-16772

In Akaunting versions sync()` call without verifying whether the caller is authorized to manage roles. Users only requir

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-862

漏洞预警2026-08-14 发布INFO

The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypa...

CVE-2026-72833

The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerabili

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-08-14 发布INFO

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers...

CVE-2026-72830

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowin

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-08-14 发布INFO

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enforce the sc...

CVE-2026-72829

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's cr

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-08-14 发布INFO

Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a ...

CVE-2026-72828

Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. Th

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-08-14 发布INFO

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unaut...

CVE-2026-18039

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields fro

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-08-13 发布INFO

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec...

CVE-2026-73842

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-306 #cwe-862

漏洞预警2026-08-13 发布INFO

FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SSH public key and a...

CVE-2026-73664

FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php acce

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-284 #cwe-732

漏洞预警2026-08-13 发布INFO

Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId ...

CVE-2026-73305

Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRo

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-862 #cwe-863

安全公告2026-08-13 发布INFO

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to...

CVE-2026-18101

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper management of thre