#cwe-290

共收录 318 条相关情报。

漏洞预警2026-09-11 发布MEDIUM

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any...

CVE-2026-90447

该漏洞属于典型的访问控制失效（Broken Access Control）与认证路径不一致问题。问题根源在于网关/反向代理层的路由规则：同一后端服务配置了两套不同的认证与授权机制，而系统在二者之间进行选择时，依据的是客户端可自行提供的请求头

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-09-11 发布INFO

matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients. Starting in version 0.12.0 and prior to version 0.1...

CVE-2026-45056

matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix cli

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-09-10 发布INFO

An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privil...

CVE-2026-63427

An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-09-10 发布INFO

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User sur...

CVE-2026-88011

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

安全公告2026-09-10 发布INFO

Traefik: ForwardAuth identity spoofing via dot-form header alias

CVE-2026-88879 · CVE-2026-88011

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-290

漏洞预警2026-09-10 发布INFO

Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.

CVE-2026-66674

Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-09-10 发布INFO

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-...

CVE-2026-88879

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11,

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

安全公告2026-09-10 发布INFO

Traefik before v2.11.56 Identity Spoofing via Header Alias

CVE-2026-88011 · CVE-2026-88879

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11,

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-290

漏洞预警2026-09-08 发布INFO

Authentication bypass by spoofing in Windows Netlogon allows an unauthorized attacker to perform spoofing over an adjacent network.

CVE-2026-62759

Authentication bypass by spoofing in Windows Netlogon allows an unauthorized attacker to perform spoofing over an adjace

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

安全公告2026-09-07 发布INFO

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack...

CVE-2026-86478

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthent

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-290 #severity:critical

漏洞预警2026-09-07 发布INFO

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address

CVE-2026-86478

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthent

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-09-07 发布INFO

Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For...

CVE-2026-84186

Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

安全公告2026-09-05 发布INFO

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header...

CVE-2026-86196

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-290 #severity:high

漏洞预警2026-09-05 发布INFO

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect ...

CVE-2026-86196

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

安全公告2026-09-04 发布INFO

MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing,...

CVE-2026-85432

MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated att

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-290 #severity:high

漏洞预警2026-09-03 发布INFO

MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying ...

CVE-2026-85432

MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated att

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

安全公告2026-09-03 发布INFO

SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy

CVE-2026-72809

**CVE:** This vulnerability corresponds to [CVE-2026-72809](https://nvd.nist.gov/vuln/detail/CVE-2026-72809). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-290 #severity:high

漏洞预警2026-09-03 发布INFO

Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions.

CVE-2026-84849

Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-09-03 发布INFO

Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.

CVE-2026-84766

Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-09-03 发布INFO

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certificate that...

CVE-2026-82180

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication polic

历史摘要 · 未重新核验 · NVD

#cve #cwe-290 #cwe-295