#cwe-345

共收录 416 条相关情报。

漏洞预警2026-09-17 发布INFO

MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicalda...

CVE-2026-54608

MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/Syste

历史摘要 · 未重新核验 · NVD

#cve #cwe-345 #cwe-862

漏洞预警2026-09-17 发布INFO

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initiali...

CVE-2026-54239

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertex

历史摘要 · 未重新核验 · NVD

#cve #cwe-345 #cwe-639

安全公告2026-09-17 发布INFO

FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope

CVE-2026-54239

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertex

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-345 #cwe-639

漏洞预警2026-09-17 发布INFO

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c accepted non...

CVE-2026-54586

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mp

历史摘要 · 未重新核验 · NVD

#cve #cwe-319 #cwe-345

漏洞预警2026-09-17 发布INFO

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmport/fetch.c could return success when bootstrap index hash verificat...

CVE-2026-54581

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmport/fetch.c

历史摘要 · 未重新核验 · NVD

#cve #cwe-345 #cwe-347

漏洞预警2026-09-17 发布INFO

mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp_seq and parsed the reply using a fix...

CVE-2026-54579

mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without valida

历史摘要 · 未重新核验 · NVD

#cve #cwe-125 #cwe-345

漏洞预警2026-09-17 发布INFO

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to ...

CVE-2026-86039

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-290 #cwe-345

漏洞预警2026-09-17 发布INFO

libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/ut...

CVE-2026-86038

libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses t

历史摘要 · 未重新核验 · NVD

#cve #cwe-345 #cwe-347

漏洞预警2026-09-17 发布INFO

Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity vulnerability. A low privileged attacker with remote access could p...

CVE-2026-26950

Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity vulnerabil

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-09-17 发布INFO

Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing. This issue affects FluentAuth: from n/a through 2.1.2.

CVE-2026-78296

Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing.

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-09-17 发布INFO

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-paym...

CVE-2026-91017

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-09-16 发布INFO

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snapshots, t...

CVE-2026-61591

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

历史摘要 · 未重新核验 · NVD

#cve #cwe-345 #cwe-915

安全公告2026-09-16 发布INFO

RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

CVE-2026-63127

### Summary The `rmcp` library does not validate the `resource` parameter in OAuth Protected Resource metadata (RFC 9728

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #rust #cwe-345 #severity:high

安全公告2026-09-16 发布INFO

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

CVE-2026-61591

### Impact For views that opt into state snapshots, the snapshot `state_json` embedded in the client page was restored o

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-345 #cwe-915 #severity:high

漏洞预警2026-09-16 发布INFO

kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter against the trust.host...

CVE-2026-88592

kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint /getCorsFi

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-09-16 发布INFO

On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the s...

CVE-2026-73435

On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafte

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-09-16 发布INFO

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow...

CVE-2026-77955

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes)

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-09-16 发布INFO

The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports t...

CVE-2026-84906

The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is appli

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

安全公告2026-09-16 发布INFO

On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an...

CVE-2026-73450

On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-345 #severity:high

漏洞预警2026-09-16 发布INFO

On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can s...

CVE-2026-73450

On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with a

历史摘要 · 未重新核验 · NVD

#cve #cwe-345