#cwe-304

共收录 14 条相关情报。

← 返回所有主题

漏洞预警2026-10-20 发布INFO

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attacker...

CVE-2026-101296

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a

历史摘要 · 未重新核验 · NVD

#cve #cwe-304

漏洞预警2026-09-26 发布INFO

grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated()...

CVE-2026-100667

grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challeng

历史摘要 · 未重新核验 · NVD

#cve #cwe-304

安全公告2026-09-02 发布INFO

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability...

CVE-2023-54391

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-contro

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-304 #severity:critical

漏洞预警2026-09-01 发布INFO

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to a...

CVE-2023-54391

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-contro

历史摘要 · 未重新核验 · NVD

#cve #cwe-304

漏洞预警2026-08-24 发布INFO

An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal.

CVE-2026-59564

An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and th

历史摘要 · 未重新核验 · NVD

#cve #cwe-304

漏洞预警2026-08-19 发布INFO

phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid crede...

CVE-2026-76207

phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued befo

历史摘要 · 未重新核验 · NVD

#cve #cwe-304

安全公告2026-08-18 发布INFO

devpi-server may leak database contents

CVE-2026-54723

### Impact If the replication protocol is enabled by using the ``primary`` (or deprecated ``master``) role for a server

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-304 #severity:medium

漏洞预警2026-08-12 发布INFO

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when m...

CVE-2026-49467

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-303 #cwe-304

漏洞预警2026-08-06 发布INFO

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, ...

CVE-2026-61466

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` val

历史摘要 · 未重新核验 · NVD

#cve #cwe-304

安全公告2026-06-29 发布INFO

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was...

CVE-2026-55957

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-304

漏洞预警2026-06-29 发布INFO

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate wit...

CVE-2026-55957

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate

历史摘要 · 未重新核验 · NVD

#cve #cwe-304

漏洞预警2026-06-26 发布INFO

It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to...

CVE-2026-57915

It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized

历史摘要 · 未重新核验 · NVD

#cve #cwe-304

漏洞预警2026-05-12 发布INFO

ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The hardening commit was merged and then silently stripped fr...

CVE-2026-44547

ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-304

漏洞预警2026-05-08 发布HIGH

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, /users/login issues a temporary JWT (temp_t...

CVE-2026-42452

Termix 是一款基于 Web 的服务端管理平台，提供 SSH 终端、隧道和文件编辑功能。在版本 2.1.0 之前，/users/login 接口为启用了 TOTP 双因素认证（2FA）的账户签发一个临时 JWT（temp_token），

历史摘要 · 未重新核验 · NVD

#cve #cwe-304