#cwe-347

共收录 355 条相关情报。

← 返回所有主题
漏洞预警2026-06-03 发布INFO

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Prior to versio...

CVE-2026-45614

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Corte

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-03 发布INFO

An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenati...

CVE-2026-6873

An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.http.HttpRequest.get_signed_cookie` in

历史摘要 · 未重新核验 · NVD

安全公告2026-06-01 发布INFO

kas checks out SHA-like git branches as valid commits

CVE-2026-47191

### Impact When relying solely on a git commit ID (SHA-1 or SHA-256) to qualify if a checkout of a repository is equival

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-05-29 发布INFO

Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification

CVE-2026-47212

### Description The Twilio SMS notifier bridge ships a webhook request parser used to authenticate and decode the statu

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-05-28 发布MEDIUM

A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content i...

CVE-2026-9793

CVE-2026-9793 是 Keycloak 中的一个中等严重性漏洞。Keycloak 是一个开源的身份和访问管理解决方案,广泛用于实现 OpenID Connect (OIDC) 和 SAML 协议。该漏洞存在于 JWE(JSON W

历史摘要 · 未重新核验 · NVD

漏洞预警2026-05-27 发布INFO

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to 2.0.4, a critical authentication vulnerability was identified in OpenLearnX that could all...

CVE-2026-44720

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to 2.0.4, a critical authentication

历史摘要 · 未重新核验 · NVD

漏洞预警2026-05-27 发布INFO

The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implementing any data ve...

CVE-2025-41669

The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloade

历史摘要 · 未重新核验 · NVD

安全公告2026-05-26 发布INFO

Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

CVE-2026-42462

### Summary An attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-05-26 发布INFO

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker who can MITM the TLS connection between the client and the ID...

CVE-2026-45575

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker who

历史摘要 · 未重新核验 · NVD

安全公告2026-05-19 发布INFO

Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

CVE-2026-46354

## Summary `azureidentity.Validate()` verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but neve

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-05-15 发布INFO

Improper Verification of Cryptographic Signature in com.oviva.telematik:epa4all-client

CVE-2026-45575

### Impact An attacker who can MITM the TLS connection between the client and the IDP (within the TI network) can substi

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-05-15 发布INFO

The bitcoinj library is a Java implementation of the Bitcoin protocol. Prior to 0.17.1, ScriptExecution.correctlySpends() contains two fast-path verification bugs for standard P...

CVE-2026-44714

The bitcoinj library is a Java implementation of the Bitcoin protocol. Prior to 0.17.1, ScriptExecution.correctlySpends(

历史摘要 · 未重新核验 · NVD

漏洞预警2026-05-15 发布INFO

LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parameter as the verification key for an HS256/HS384/HS512 toke...

CVE-2026-44699

LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parame

历史摘要 · 未重新核验 · NVD

漏洞预警2026-05-15 发布INFO

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag obj...

CVE-2026-44309

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsi

历史摘要 · 未重新核验 · NVD

漏洞预警2026-05-15 发布INFO

Improper verification of cryptographic signature in the Radeon RGB tool could allow a malicious file placed in the installation directory to be run with elevated privileges pote...

CVE-2024-36334

Improper verification of cryptographic signature in the Radeon RGB tool could allow a malicious file placed in the insta

历史摘要 · 未重新核验 · NVD

漏洞预警2026-05-13 发布INFO

azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single v...

CVE-2026-42602

azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in

历史摘要 · 未重新核验 · NVD

安全公告2026-05-13 发布INFO

An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an...

CVE-2026-0265

An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with n

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-05-13 发布INFO

An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Clou...

CVE-2026-0265

An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with n

历史摘要 · 未重新核验 · NVD

安全公告2026-05-13 发布INFO

OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover

CVE-2026-44720

### Overview A critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-05-12 发布INFO

Improper authentication in Azure SDK allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-33117

Improper authentication in Azure SDK allows an unauthorized attacker to bypass a security feature over a network.

历史摘要 · 未重新核验 · NVD