#cwe-290

共收录 318 条相关情报。

漏洞预警2026-10-02 发布INFO

User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism.

CVE-2026-104733

User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attacker to impersonate arbitrary users via un

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-10-02 发布INFO

YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauth...

CVE-2026-104445

YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the ver

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

安全公告2026-10-02 发布INFO

YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing

CVE-2026-104445

YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the ver

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-290

漏洞预警2026-10-01 发布INFO

Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions.

CVE-2026-103347

Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-09-29 发布INFO

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. Th...

CVE-2026-101280

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-290

漏洞预警2026-09-28 发布INFO

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including...

CVE-2026-93538

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cl

历史摘要 · 未重新核验 · NVD

#cve #cwe-290 #cwe-639

安全公告2026-09-28 发布INFO

Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet

CVE-2026-93538

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cl

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-290 #cwe-639

漏洞预警2026-09-23 发布INFO

Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

CVE-2026-95524

Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-09-23 发布INFO

Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

CVE-2026-95523

Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-09-23 发布INFO

Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.

CVE-2026-94457

Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

安全公告2026-09-23 发布INFO

9router /v1 APIs has unauthenticated access via reverse proxy locality collapse

CVE-2026-56675

## Summary 9router treats local loopback requests as trusted and allows access to `/v1/*` without an API key. In a docu

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-287 #cwe-290 #cwe-306 #cwe-441

漏洞预警2026-09-23 发布INFO

The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated...

CVE-2026-93511

The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

安全公告2026-09-23 发布INFO

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header...

CVE-2026-92929

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary c

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-290 #severity:medium

漏洞预警2026-09-23 发布INFO

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An una...

CVE-2026-92929

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary c

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-09-21 发布INFO

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin() returns an existin...

CVE-2026-55210

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-09-21 发布INFO

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-...

CVE-2026-63329

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate

历史摘要 · 未重新核验 · NVD

#cve #cwe-116 #cwe-290

安全公告2026-09-18 发布INFO

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

CVE-2026-61682

# Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-290 #cwe-302 #cwe-348 #severity:critical

漏洞预警2026-09-18 发布INFO

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove ...

CVE-2026-61682

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior t

历史摘要 · 未重新核验 · NVD

#cve #cwe-290 #cwe-302 #cwe-348

安全公告2026-09-18 发布INFO

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

CVE-2026-61682

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior t

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-290 #cwe-302 #cwe-348

漏洞预警2026-09-18 发布INFO

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due ...

CVE-2026-85511

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oau

历史摘要 · 未重新核验 · NVD

#cve #cwe-290