#cwe-287

共收录 1081 条相关情报。

漏洞预警2026-08-16 发布INFO

A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the component httpd. The manip...

CVE-2026-19924

A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the functio

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

安全公告2026-08-16 发布INFO

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket...

CVE-2026-73054

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differe

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-287 #severity:high

漏洞预警2026-08-15 发布HIGH

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication ...

CVE-2026-73054

CVE-2026-73054 影响 SiYuan 笔记软件 v3.7.4 之前版本。该漏洞存在于 WebSocket 端点的认证绕过机制，源自认证豁免流程与会话隔离检查对查询参数解析的差异性。攻击者无需任何认证或用户交互，仅需构造包含重复查

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-15 发布INFO

The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The `synchroni...

CVE-2026-15341

The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-15 发布INFO

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_create_wp_user() AJAX h...

CVE-2026-15303

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

安全公告2026-08-15 发布INFO

A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts...

CVE-2026-74240

A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO)

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-287 #severity:medium

漏洞预警2026-08-14 发布MEDIUM

A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience veri...

CVE-2026-74240

CVE-2026-74240 是 Red Hat Quay 中关于 JSON Web Token（JWT）验证的漏洞。Red Hat Quay 是一款企业级容器镜像仓库产品，支持联合机器人账户和单点登录（SSO）认证。根据 NVD 描述，该

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

安全公告2026-08-14 发布INFO

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and...

CVE-2026-17182

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensit

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-287 #severity:critical

安全公告2026-08-14 发布INFO

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain...

CVE-2026-16905

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due t

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-287 #severity:medium

安全公告2026-08-14 发布INFO

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain...

CVE-2026-17175

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due t

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-287 #severity:high

漏洞预警2026-08-14 发布INFO

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI...

CVE-2026-17182

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensit

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-14 发布INFO

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement.

CVE-2026-17175

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due t

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-14 发布INFO

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication.

CVE-2026-16905

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due t

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-14 发布INFO

Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vuln...

CVE-2026-48528

Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 th

历史摘要 · 未重新核验 · NVD

#cve #cwe-89 #cwe-287

安全公告2026-08-14 发布INFO

Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts

CVE-2026-35511

The OAuth callback handler links incoming OAuth identities (Google, GitHub, etc.) to existing accounts matched by email

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-287 #severity:high

漏洞预警2026-08-14 发布INFO

The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that...

CVE-2026-16739

The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-08-13 发布INFO

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-...

CVE-2026-73840

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-290 #cwe-345

漏洞预警2026-08-13 发布INFO

Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without getEmailVeri...

CVE-2026-73302

Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

安全公告2026-08-13 发布INFO

Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

CVE-2026-73302

Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/pa

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287

安全公告2026-08-13 发布INFO

OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

CVE-2026-73840

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287 #cwe-290 #cwe-345