#cwe-284

共收录 1965 条相关情报。

漏洞预警2026-08-29 发布INFO

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enfo...

CVE-2026-77010

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation che

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-29 发布INFO

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing ...

CVE-2026-77008

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-29 发布INFO

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a ...

CVE-2026-76586

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-28 发布INFO

Arc is an open, SQL-native time-series database for telemetry. From 26.02.1 until 26.06.2, Arc Enterprise clustering accepts cluster join requests without authentication when cl...

CVE-2026-55678

Arc is an open, SQL-native time-series database for telemetry. From 26.02.1 until 26.06.2, Arc Enterprise clustering acc

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-287 #cwe-306

安全公告2026-08-28 发布INFO

arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset

CVE-2026-55678

## Summary Arc Enterprise clustering accepts cluster join requests without authentication when `cluster.enabled=true` b

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-284 #cwe-287 #cwe-306 #severity:medium

漏洞预警2026-08-28 发布INFO

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated s...

CVE-2026-54745

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-918

漏洞预警2026-08-28 发布INFO

None None None No publicly available exploits are known.

CVE-2026-40204

None None None No publicly available exploits are known.

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-28 发布INFO

A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially cr...

CVE-2026-78618

A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operatio

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-841

漏洞预警2026-08-27 发布INFO

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a...

CVE-2026-37067

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauth

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-27 发布INFO

ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in...

CVE-2026-18886

ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. Th

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-27 发布INFO

Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affect...

CVE-2026-64896

Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functiona

历史摘要 · 未重新核验 · NVD

#cve #cwe-284 #cwe-732

漏洞预警2026-08-27 发布INFO

If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for ...

CVE-2026-81573

If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

安全公告2026-08-27 发布INFO

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish...

CVE-2026-77034

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-284 #severity:medium

漏洞预警2026-08-27 发布INFO

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1 - Any visitor holding their own session token can...

CVE-2026-77034

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-27 发布INFO

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a sto...

CVE-2026-16569

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 doe

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-26 发布HIGH

The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit ...

CVE-2026-58108

该漏洞存在于个人访问令牌（PAT）的删除功能中。代码意图是从 PersonalAccessTokenDB 表中删除当前用户自己的令牌，但删除查询中的过滤条件错误地使用了 Session 表的字段，且未在 PersonalAccessToke

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

安全公告2026-08-26 发布INFO

Personal access token delete filters on Session columns while deleting from PersonalAccessTokenDB

CVE-2026-58108

The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no jo

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-284

漏洞预警2026-08-26 发布MEDIUM

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to un...

CVE-2026-77695

CVE-2026-77695 影响 WordPress 插件 'Return Refund and Exchange For WooCommerce' 的 4.6.4 之前版本。该插件用于管理 WooCommerce 订单的退货、退款和换货

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-26 发布MEDIUM

The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a...

CVE-2026-74929

CVE-2026-74929 是 WordPress 的 Project Manager 插件（版本 4.0.7 之前）中存在的一个访问控制不当漏洞。该插件提供的多个 REST API 路由未检查请求用户是否属于某个项目，导致任何已登录用户

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-08-26 发布INFO

The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-...

CVE-2026-16986

The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored s

历史摘要 · 未重新核验 · NVD

#cve #cwe-284