共收录 13 条相关安全情报。
← 返回所有主题IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This makes it possible for unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication c
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
CVE-2026-15980 是 MyHome Core WordPress 插件中的一个高危身份验证绕过漏洞，影响所有版本直至并包括 4.4.5。漏洞根因在于 send_link() AJAX 处理器缺少权限检查，以及 activate() 函数对令牌验证不充分。攻击者无需任何身份认证即可利用这些缺陷：首先通过 send_link() 为尚未确认的任意用户（包括管理员）生成有效的激活令牌，然后利用该令牌配合不完善的验证机制完成激活流程，从而获得该用户账户的合法认证 cookie，最终实现完全账户接管。该漏洞的成功利用存在前置条件：MyHome 主题必须配置为传统/WPBakery 模式，并且前端注册及确认邮件功能需要开启；同时，目标账户不能已设置 myhome_agent_confirmed 元数据。CVSS 评分为 9.8（严重），攻击向量为网络，攻击复杂度低，无需权限和用户交互，机密性、完整性、可用性影响均为高。目前该漏洞尚未被列入已知被利用漏洞目录（KEV），也没有在野利用标记。建议受影响用户立即将 MyHome Core 插件升级到 4.4.5 之后的修复版本，并在升级前通过 Web 应用防火墙或禁用相关功能来降低风险。
💡 影响/原因: 该漏洞允许未认证攻击者完全接管任意账户（包括管理员），导致网站完全失陷。CVSS 9.8 且无需用户交互，若条件满足，攻击门槛极低。
The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple id_token and decoding only its base64 payload without verifying the JWT signature against Apple's public keys or validating the issuer, audience, or expiry claims, combined with the security nonce r
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
CVE-2026-8457 影响 WooCommerce Social Login 插件（WordPress）所有版本直至 2.8.7。该插件为 WooCommerce 提供社交登录功能，其中苹果登录处理器存在严重认证绕过漏洞。漏洞根源在于插件接受苹果返回的 id_token 后，仅对 JWT 的 base64 编码载荷进行解码，完全没有验证 JWT 签名是否由苹果公钥签发，也不校验 issuer（发行方）、audience（受众）和 expiry（过期时间）等标准声明。与此同时，触发登录流程所需的安全 nonce 被插件以本地化 JavaScript 对象形式直接输出到登录页面，未认证用户即可获取。组合利用这两点，攻击者可以伪造任意 id_token，在其载荷中填入目标 WordPress 用户的电子邮件地址（例如管理员邮箱），插件会直接以该邮箱在 WordPress 用户表中查找并匹配账户，成功后立即创建已认证会话，从而以该用户身份登录。整个攻击链无需任何前置权限，也不涉及用户交互，攻击面完全对外开放。CVSS 评分为 9.8（严重），攻击向量为网络，攻击复杂度低，影响机密性、完整性和可用性。目前元数据中未标明该漏洞已列入 KEV 或存在在野利用证据，但鉴于严重性，建议立即采取缓解措施。
💡 影响/原因: 该漏洞使任何未认证访问者都能完全接管 WordPress 站点，包括管理员账户，导致数据泄露、网站篡改或恶意软件部署风险，属于最严重的身份认证缺陷。
The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the `eventer_verification_code` user meta field when a user requests a password reset. The plaintext key stored in `wp_usermeta` can be used with the plugin's custom reset action to set a new password for
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the `email_verified` claim was only enforced when present as a boolean
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the `email_verified` claim was only enforced when present as a boolean
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
### Summary Two flaws in Coder's OIDC login chained into account takeover: email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the `email_verified` claim was only enforced when present as a boolean `false` so an absent or non-boolean claim was treated as verified. ### Impact An attacker who could authenticate at the config
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the `shiro-guice` module instead of the `shiro-spring` module. This issue affects all Apache Shiro versions through
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估