#cwe-359

共收录 48 条相关情报。

← 返回所有主题

安全公告2026-10-20 发布INFO

@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

CVE-2026-111753

An incomplete fix for [GHSA-58c5-g7wp-6w37](https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37)

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-201 #cwe-359 #severity:medium

漏洞预警2026-09-17 发布INFO

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs ho...

CVE-2026-54565

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox e

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-359 #cwe-918 #cwe-1385

安全公告2026-09-16 发布INFO

djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

CVE-2026-61588

### Impact When a Django `Model` instance is assigned to a **public** view attribute, djust serialized it to the client

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-200 #cwe-359 #severity:medium

安全公告2026-09-16 发布INFO

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in...

CVE-2026-76855

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints hand

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-359 #severity:high

漏洞预警2026-09-15 发布INFO

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7_web_auth_log_dump_cgi.c, audit_get_cgi.c, and m...

CVE-2026-76855

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints hand

历史摘要 · 未重新核验 · NVD

#cve #cwe-359

漏洞预警2026-09-14 发布INFO

A privacy issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to track user...

CVE-2026-86904

A privacy issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 an

历史摘要 · 未重新核验 · NVD

#cve #cwe-359

漏洞预警2026-09-14 发布INFO

A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to identi...

CVE-2026-84606

A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-330 #cwe-359

漏洞预警2026-09-10 发布INFO

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. Video rows incl...

CVE-2026-88875

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive u

历史摘要 · 未重新核验 · NVD

#cve #cwe-359

漏洞预警2026-09-08 发布INFO

Exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information loc...

CVE-2026-69351

Exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play (UPnP) Device Host

历史摘要 · 未重新核验 · NVD

#cve #cwe-359

漏洞预警2026-08-31 发布INFO

HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper ha...

CVE-2026-21827

HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive in

历史摘要 · 未重新核验 · NVD

#cve #cwe-359

漏洞预警2026-08-21 发布INFO

CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the other_sessions array, which e...

CVE-2026-53497

CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without aut

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-359

漏洞预警2026-08-13 发布INFO

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

CVE-2026-58510

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on pu

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-281 #cwe-359

漏洞预警2026-08-10 发布INFO

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1,...

CVE-2026-48048

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Sta

历史摘要 · 未重新核验 · NVD

#cve #cwe-359

漏洞预警2026-07-31 发布INFO

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes...

CVE-2026-55496

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActi

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-359

安全公告2026-07-31 发布INFO

Cloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search because SearchActive() omits the active-status predicate

CVE-2026-55496

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActi

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-359

安全公告2026-07-24 发布INFO

Cloudreve: Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emails

CVE-2026-55496

## Summary `GET /api/v4/user/search` is available to any logged-in user. The service calls `userClient.SearchActive`,

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-200 #cwe-359 #severity:medium

安全公告2026-07-21 发布INFO

Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

CVE-2026-58510

## Summary GHSA-8fwc-qjw5-rvgp ("Gitea may send release notification emails for private repositories to users whose acc

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-200 #cwe-281 #cwe-359 #severity:medium

安全公告2026-07-18 发布INFO

Exposure of private personal information to an unauthorized actor in Windows RDP allows an...

CVE-2026-56171

Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disc

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-359 #severity:high

漏洞预警2026-07-17 发布HIGH

Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information over a network.

CVE-2026-56171

CVE-2026-56171 是 Windows 远程桌面协议（RDP）中的一个信息泄露漏洞。攻击者可在网络层面利用该漏洞，无需身份认证，但需要诱骗用户（例如通过社会工程）与恶意 RDP 服务器交互。漏洞评级为高（CVSS 7.1），主要影

历史摘要 · 未重新核验 · NVD

#cve #cwe-359

漏洞预警2026-07-14 发布INFO

Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally.

CVE-2026-50657

Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to

历史摘要 · 未重新核验 · NVD

#cve #cwe-359