#cwe-287

共收录 1081 条相关情报。

漏洞预警2026-08-19 发布INFO

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-se...

CVE-2026-62669

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-19 发布INFO

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to access NFS-exported filesystems due to improper authentication.

CVE-2026-16686

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to access NFS-exported filesystems due to im

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-19 发布INFO

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to gain root privileges due to improper authentication.

CVE-2026-16656

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to gain root privileges due to improper auth

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-19 发布INFO

The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a ...

CVE-2026-19842

The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing t

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-19 发布INFO

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied ...

CVE-2026-19709

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually bee

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-19 发布INFO

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, all...

CVE-2026-18031

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

安全公告2026-08-19 发布INFO

Tapo C200 v5 contains an improper authentication vulnerability within the login authentication...

CVE-2026-15315

Tapo C200 v5 contains an improper authentication vulnerability within the login authentication verification module. An a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-287 #severity:high

漏洞预警2026-08-18 发布INFO

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to modify ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithu...

CVE-2026-53958

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-915

漏洞预警2026-08-18 发布INFO

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled,...

CVE-2026-50191

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account tak

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-288

漏洞预警2026-08-18 发布INFO

Tapo C200 v5 contains an improper authentication vulnerability within the login authentication verification module. An attacker on the local network can exploit weaknesses in ch...

CVE-2026-15315

Tapo C200 v5 contains an improper authentication vulnerability within the login authentication verification module. An a

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-18 发布INFO

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 a...

CVE-2026-60679

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-18 发布INFO

Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path in lib/Froxlor/Api/FroxlorRPC.php and FroxlorRPC::validateAuth accepts an API ...

CVE-2026-52793

Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path in lib/Froxlor/Api/Fr

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-18 发布INFO

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account owners...

CVE-2026-44472

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-18 发布INFO

Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks.

CVE-2026-73337

Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-18 发布INFO

A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign...

CVE-2026-75774

A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-17 发布INFO

An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1. An attacker in a privileged network position may be ab...

CVE-2026-65329

An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-17 发布CRITICAL

A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation. Performing a manip...

CVE-2026-19977

该漏洞影响EFM ipTIME A3004T路由器固件版本14.19.0。漏洞位于Session Validation（会话验证）组件中的httpcon_check_session_url函数。该函数可能未能正确验证用户会话的合法性，导致身

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-17 发布MEDIUM

A security flaw has been discovered in treefrogframework treefrog-framework up to 2.11.2. This vulnerability affects the function std::strncmp of the file src/tsessioncookiestor...

CVE-2026-19974

CVE-2026-19974 是 treefrogframework 的 treefrog-framework 项目（至 2.11.2 版本）中的一个安全漏洞。该漏洞位于 src/tsessioncookiestore.cpp 文件中的 s

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-17 发布INFO

A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes mis...

CVE-2026-19971

A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of th

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306

安全公告2026-08-17 发布INFO

treefrogframework treefrog-framework Session Cookie tsessioncookiestore.cpp strncmp improper authentication

CVE-2026-19974

A security flaw has been discovered in treefrogframework treefrog-framework up to 2.11.2. This vulnerability affects the

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287