#cwe-287

共收录 1077 条相关情报。

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check,...

CVE-2026-105639

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for an

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-287 #cwe-639

安全公告2026-10-05 发布INFO

Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)

CVE-2026-105640

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth an

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287 #cwe-290

安全公告2026-10-05 发布INFO

Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

CVE-2026-105639

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for an

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-287 #cwe-639

漏洞预警2026-10-05 发布INFO

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.

CVE-2026-79820

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-05 发布INFO

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Performing a manipul...

CVE-2026-105307

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filt

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

安全公告2026-10-05 发布INFO

A weakness has been identified in kishor-23 food-waste-management-system...

CVE-2026-105170

A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-287 #severity:medium

漏洞预警2026-10-05 发布INFO

A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected is an unknow...

CVE-2026-105170

A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

安全公告2026-10-04 发布INFO

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2...

CVE-2026-105213

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-287 #severity:high

安全公告2026-10-04 发布INFO

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the...

CVE-2026-105210

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-287 #severity:high

安全公告2026-10-04 发布INFO

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted...

CVE-2026-105212

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UI

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-287 #severity:high

漏洞预警2026-10-04 发布INFO

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated org...

CVE-2026-105213

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-10-04 发布HIGH

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment ...

CVE-2026-105212

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UI

来源摘录 · NVD

#cve #cwe-287

漏洞预警2026-10-04 发布HIGH

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act ...

CVE-2026-105210

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose

来源摘录 · NVD

#cve #cwe-287

安全公告2026-10-04 发布INFO

ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations

CVE-2026-105213

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287

安全公告2026-10-04 发布INFO

ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

CVE-2026-105212

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UI

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287

安全公告2026-10-04 发布INFO

ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

CVE-2026-105210

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287

漏洞预警2026-10-04 发布INFO

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Perf...

CVE-2026-105133

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

安全公告2026-10-03 发布INFO

In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420)...

CVE-2026-71885

In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-287 #severity:critical

安全公告2026-10-03 发布INFO

The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for...

CVE-2026-97343

The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to I

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-287 #severity:medium

漏洞预警2026-10-03 发布INFO

In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNode.verif...

CVE-2026-71885

In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-295