#cwe-471

共收录 15 条相关情报。

漏洞预警2026-10-30 发布MEDIUM

i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js` checks property existence with the in operator and recurses ...

CVE-2026-63402

i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js` che

来源摘录 · NVD

#cve #cwe-1321 #cwe-471

安全公告2026-10-30 发布LOW

Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

CVE-2026-118780

### Summary When a CA store created by `pki.createCaStore()` holds two or more certificates with the same subject name,

来源摘录 · GitHub Advisory

#advisory #cwe-295 #cwe-471 #npm #severity:low

漏洞预警2026-10-30 发布LOW

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, `bit_TV_to_utf8()` in `src/bits.c` can write to the caller-provided `src` buffer despite accepting const...

CVE-2026-54610

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, `bit_TV_to_utf8()` in `src/bits.c` can write to

来源摘录 · NVD

#cve #cwe-471 #cwe-703

漏洞预警2026-10-29 发布LOW

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(...

CVE-2026-118780

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-295 #cwe-471 #npm #severity:low

安全公告2026-10-01 发布INFO

vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor

CVE-2026-92949

### Summary Untrusted JavaScript running inside `new VM().run()` / `new NodeVM().run()` can bypass `vm.freeze()` / `vm.r

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-471 #cwe-693 #severity:medium

漏洞预警2026-09-17 发布INFO

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly...

CVE-2026-92949

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowin

历史摘要 · 未重新核验 · NVD

#cve #cwe-471

安全公告2026-09-02 发布INFO

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection...

CVE-2026-84664

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler d

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-471 #severity:medium

漏洞预警2026-09-02 发布INFO

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker...

CVE-2026-84664

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler d

历史摘要 · 未重新核验 · NVD

#cve #cwe-471 #cwe-494

漏洞预警2026-08-27 发布INFO

Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4...

CVE-2026-59299

Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Sp

历史摘要 · 未重新核验 · NVD

#cve #cwe-471

安全公告2026-08-07 发布INFO

Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized...

CVE-2026-50481

Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privile

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-471 #severity:critical

漏洞预警2026-08-07 发布INFO

Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.

CVE-2026-50481

Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privile

历史摘要 · 未重新核验 · NVD

#cve #cwe-471

漏洞预警2026-06-22 发布INFO

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, to opt...

CVE-2026-54267

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-471

安全公告2026-05-20 发布INFO

Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with...

CVE-2026-8492

Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource L

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-471

漏洞预警2026-05-19 发布INFO

Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing. This issue affects Translate Drupal wi...

CVE-2026-8492

Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource L

历史摘要 · 未重新核验 · NVD

#cve #cwe-471

安全公告2026-05-13 发布INFO

Nautobot: GitRepository.current_head field should not be writable through REST API

CVE-2026-44798

### Impact A user with access to add/change a GitRepository record could use the REST API to directly set the `current_

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-471 #cwe-749 #severity:high