#cwe-287

共收录 1077 条相关情报。

漏洞预警2026-09-20 发布MEDIUM

A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth ...

CVE-2026-93960

CVE-2026-93960 是披露在开源联邦式图片社交平台 Pixelfed 中的一个认证缺失（missing authentication）类漏洞，影响版本为 0.12.11 及之前。问题位于 app/Http/Controllers/

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

安全公告2026-09-19 发布INFO

OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify...

CVE-2026-93984

OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptograph

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-287 #severity:medium

漏洞预警2026-09-19 发布INFO

OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filteri...

CVE-2026-93984

OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptograph

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

安全公告2026-09-19 发布INFO

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for...

CVE-2026-89093

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Info

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-287 #severity:medium

漏洞预警2026-09-19 发布INFO

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and i...

CVE-2026-89093

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Info

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

安全公告2026-09-18 发布INFO

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a...

CVE-2026-75878

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated sessio

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-287 #severity:critical

漏洞预警2026-09-18 发布INFO

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO h...

CVE-2026-75878

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated sessio

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-09-18 发布INFO

A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This affects an unknown function of the file backend/app/dependen...

CVE-2026-93559

A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This aff

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

安全公告2026-09-18 发布INFO

Forget-C Jellyfish AI Short Drama Studio FastAPI dependencies.py missing authentication

CVE-2026-93559

A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This aff

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287 #cwe-306

漏洞预警2026-09-18 发布INFO

A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function application/modules/...

CVE-2026-93532

A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf7

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-09-18 发布INFO

An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to compromise the security of the system. Q...

CVE-2024-38639

An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-09-18 发布INFO

The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unaut...

CVE-2026-85350

The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

安全公告2026-09-18 发布INFO

Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV...

CVE-2026-82980

Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The D

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-287 #severity:medium

漏洞预警2026-09-18 发布INFO

Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absolute request URI wi...

CVE-2026-82980

Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The D

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-09-17 发布INFO

Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.21-alpha, the csrf_exempt_for_api_tokens() before_request hook in src/...

CVE-2026-54510

Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.21-alpha, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-352

漏洞预警2026-09-17 发布INFO

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, processScramAuthen...

CVE-2026-85716

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HT

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-390

漏洞预警2026-09-17 发布INFO

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is no...

CVE-2026-88952

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another us

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-09-17 发布INFO

Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentic...

CVE-2026-63472

Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUse

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-09-17 发布INFO

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a ...

CVE-2026-80218

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for o

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-09-17 发布INFO

AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an unini...

CVE-2026-92914

AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares

历史摘要 · 未重新核验 · NVD

#cve #cwe-287