#cwe-284

共收录 1965 条相关情报。

← 返回所有主题
漏洞预警2026-09-18 发布INFO

A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/[...path]/+server.ts of the component User Attribute Update Endpoint. ...

CVE-2026-93504

A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/[...path]/+se

历史摘要 · 未重新核验 · NVD

安全公告2026-09-18 发布INFO

vm2 3.11.8 Sandbox Escape via crypto.setFips

CVE-2026-93604

vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allow

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-18 发布INFO

HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling...

CVE-2026-21848

HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticat

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-18 发布INFO

The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated...

CVE-2026-90976

The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an acco

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-18 发布INFO

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allo...

CVE-2026-90978

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonc

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-18 发布INFO

The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the...

CVE-2026-87965

The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appoi

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-18 发布INFO

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing una...

CVE-2026-85123

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stor

历史摘要 · 未重新核验 · NVD

安全公告2026-09-18 发布INFO

The Photos app's filter-based "smart albums" build their file listing using the search...

CVE-2026-82985

The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolder

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-09-18 发布INFO

A vulnerability in the team folders (formerly group folders) app when used in combination with...

CVE-2026-77169

A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-09-18 发布INFO

The Deck config API allows authenticated users to set board-scoped configuration keys for...

CVE-2026-77170

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without va

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-18 发布INFO

The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album o...

CVE-2026-82985

The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolder

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-18 发布INFO

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manag...

CVE-2026-77170

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without va

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-18 发布INFO

A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-...

CVE-2026-77169

A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed

历史摘要 · 未重新核验 · NVD

安全公告2026-09-18 发布INFO

Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges...

CVE-2026-83944

Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-17 发布INFO

Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-83944

Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /db/drug_recommendor.sql. Performing a manipul...

CVE-2026-92927

A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing o

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processe...

CVE-2026-61700

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense due to insufficient access controls in a privileged servic...

CVE-2026-50610

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense d

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a privileged Named Pi...

CVE-2026-50609

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense.

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privileged service may ...

CVE-2026-50605

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insu

历史摘要 · 未重新核验 · NVD