#cwe-285

共收录 628 条相关情报。

← 返回所有主题

漏洞预警2026-09-18 发布INFO

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/a...

CVE-2026-61833

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

安全公告2026-09-18 发布INFO

zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

CVE-2026-61833

### Summary A bearer token with only `pull` and `push` scopes can successfully delete manifests and blobs from a zot re

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-285 #severity:high

安全公告2026-09-18 发布INFO

zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

CVE-2026-61833

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-285

漏洞预警2026-09-18 发布INFO

IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks.

CVE-2026-10030

IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authoriz

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-09-18 发布INFO

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administ...

CVE-2026-67102

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a lo

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

安全公告2026-09-18 发布INFO

Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate...

CVE-2026-85878

Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a netwo

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-285 #severity:critical

漏洞预警2026-09-18 发布INFO

Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.

CVE-2026-85878

Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a netwo

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-09-17 发布INFO

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-70200

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorize

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-285

漏洞预警2026-09-17 发布INFO

WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.3.0, the authenticated GET /api/v0/ws statistics WebSocke...

CVE-2026-54551

WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

安全公告2026-09-17 发布INFO

WireGuard Portal: Authenticated WebSocket /api/v0/ws broadcasts all peers' and interfaces' traffic stats to every user (missing per-user authorization)

CVE-2026-54551

WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-285

漏洞预警2026-09-16 发布INFO

A vulnerability in the web-based management interface of Cisco Identify Services Engine (ISE) could allow an authenticated, remote attacker to modify parts of the configuration ...

CVE-2026-20286

A vulnerability in the web-based management interface of Cisco Identify Services Engine (ISE) could allow an authenticat

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-09-15 发布INFO

In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no addition...

CVE-2026-58704

In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (pr

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-693

漏洞预警2026-09-15 发布INFO

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied input.

CVE-2026-11934

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to i

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-09-15 发布INFO

This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, w...

CVE-2026-21587

This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-09-15 发布INFO

This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10....

CVE-2026-21586

This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-09-15 发布INFO

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could ...

CVE-2026-55775

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities o

历史摘要 · 未重新核验 · NVD

#cve #cwe-285

漏洞预警2026-09-15 发布INFO

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in sr...

CVE-2026-49446

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-290

漏洞预警2026-09-15 发布INFO

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/{id}/rate/{rate}, /en/admin/customer/{id}/rate/{rate}, and /en/admi...

CVE-2026-52826

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/{id}/rate/

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

漏洞预警2026-09-15 发布INFO

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/{id}/members/{userId} and POST /api/teams/{id}/activities/{activityId} verify that a teamlead...

CVE-2026-52825

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/{id}/members/{userId} and POST /api/

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-862

漏洞预警2026-09-15 发布INFO

Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/{id}/restart, PATCH /api/timesheets/{id}/duplicate, and the web duplicate workflow can ...

CVE-2026-52822

Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/{id}/restart, PATCH /api/times

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-862