#cwe-287

共收录 1081 条相关情报。

漏洞预警2026-07-15 发布INFO

Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequestIp() in server/lib/headerLoginAuth.js to trust the client...

CVE-2026-55652

Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequest

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-290

漏洞预警2026-07-15 发布INFO

Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks ...

CVE-2026-55445

Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-07-15 发布INFO

Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the O...

CVE-2026-52893

Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/user

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

安全公告2026-07-15 发布INFO

Qinglong: Incomplete fix for CVE-2026-3965: Improper Authentication

CVE-2026-55445

Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287

安全公告2026-07-15 发布INFO

Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)

CVE-2026-55652

Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequest

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287 #cwe-290

安全公告2026-07-15 发布INFO

Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook

CVE-2026-52893

Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/user

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287

漏洞预警2026-07-15 发布INFO

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to th...

CVE-2026-46485

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated user

历史摘要 · 未重新核验 · NVD

#cve #cwe-15 #cwe-284 #cwe-287 #cwe-602

漏洞预警2026-07-15 发布INFO

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit a...

CVE-2026-53516

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-345

漏洞预警2026-07-15 发布INFO

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside the invited mailb...

CVE-2026-53514

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-345 #cwe-441 #cwe-862

漏洞预警2026-07-15 发布INFO

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_to...

CVE-2026-53512

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-306 #cwe-345 #cwe-863

安全公告2026-07-15 发布INFO

Dash: Users can write to config despire permissions (OIDC tested)

CVE-2026-46485

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated user

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-15 #cwe-284 #cwe-287 #cwe-602

安全公告2026-07-15 发布INFO

Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin

CVE-2026-53514

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287 #cwe-345 #cwe-441 #cwe-862

安全公告2026-07-15 发布INFO

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

CVE-2026-53512

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287 #cwe-306 #cwe-345 #cwe-863

漏洞预警2026-07-15 发布INFO

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized ac...

CVE-2026-59955

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-287

漏洞预警2026-07-15 发布INFO

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized ac...

CVE-2026-59954

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-287

安全公告2026-07-15 发布INFO

Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email

CVE-2026-53516

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-287 #cwe-345

安全公告2026-07-15 发布INFO

Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching

CVE-2026-59954

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-20 #cwe-287

安全公告2026-07-15 发布INFO

Apollo ConfigService access key authentication bypass via raw config file appId parsing

CVE-2026-59955

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-20 #cwe-287

漏洞预警2026-07-15 发布INFO

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO discovery and pre-validation flow returned organization-related SSO metadata inc...

CVE-2026-47159

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO discovery and pre-valid

历史摘要 · 未重新核验 · NVD

#cve #cwe-287

漏洞预警2026-07-15 发布INFO

Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-team-invitations, emb...

CVE-2026-44986

Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitation

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-639