#cwe-302

共收录 11 条相关情报。

← 返回所有主题
安全公告2026-09-18 发布INFO

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

CVE-2026-61682

# Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-18 发布INFO

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove ...

CVE-2026-61682

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior t

历史摘要 · 未重新核验 · NVD

安全公告2026-09-18 发布INFO

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

CVE-2026-61682

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior t

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-08-12 发布INFO

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow an a...

CVE-2026-13267

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Ident

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-06 发布INFO

@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams....

CVE-2026-5423

@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT obj

历史摘要 · 未重新核验 · NVD

安全公告2026-07-20 发布INFO

Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability

CVE-2026-50528

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-07-14 发布HIGH

Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-50528

Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.

来源摘录 · NVD

漏洞预警2026-07-14 发布HIGH

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

CVE-2026-47303

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over

来源摘录 · NVD

漏洞预警2026-06-02 发布INFO

NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-side before exchangin...

CVE-2026-34460

NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not

历史摘要 · 未重新核验 · NVD

漏洞预警2026-05-11 发布INFO

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an authentication bypass by assumed-immutable data vulnerability in Geo replic...

CVE-2025-43992

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an authentication byp

历史摘要 · 未重新核验 · NVD

漏洞预警2026-05-05 发布INFO

eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably preserve the multi-factor authentication state across authe...

CVE-2026-28510

eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably pr

历史摘要 · 未重新核验 · NVD