#cwe-598

共收录 36 条相关情报。

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration pl...

CVE-2026-113669

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passpor

历史摘要 · 未重新核验 · NVD

#cve #cwe-598

漏洞预警2026-10-12 发布INFO

A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/l...

CVE-2026-108808

A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code o

历史摘要 · 未重新核验 · NVD

#cve #cwe-598

安全公告2026-10-09 发布INFO

Nginx UI: Node Secret Credential Exposure via URL Query Parameter

CVE-2026-107807

## 1. Vulnerability Summary nginx-ui's `Node.Secret` is a master credential that bypasses all JWT/password authenticati

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-312 #cwe-598 #severity:high

漏洞预警2026-10-09 发布INFO

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in ...

CVE-2026-107807

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret mast

历史摘要 · 未重新核验 · NVD

#cve #cwe-312 #cwe-598

安全公告2026-10-09 发布INFO

Nginx UI: Node Secret Credential Exposure via URL Query Parameter

CVE-2026-107807

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret mast

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-312 #cwe-598

漏洞预警2026-09-17 发布INFO

Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to ...

CVE-2026-81632

Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone ab

历史摘要 · 未重新核验 · NVD

#cve #cwe-598

漏洞预警2026-09-15 发布INFO

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and co...

CVE-2026-55375

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQuery

历史摘要 · 未重新核验 · NVD

#cve #cwe-209 #cwe-598

漏洞预警2026-09-10 发布INFO

Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or ...

CVE-2026-88897

Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST AP

历史摘要 · 未重新核验 · NVD

#cve #cwe-598

安全公告2026-09-10 发布INFO

Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String

CVE-2026-88897

Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST AP

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-598

漏洞预警2026-09-04 发布INFO

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter as a fallback to ...

CVE-2026-61614

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tok

历史摘要 · 未重新核验 · NVD

#cve #cwe-598

安全公告2026-09-04 发布INFO

SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history

CVE-2026-61614

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tok

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-598

漏洞预警2026-08-28 发布INFO

Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via victim's ...

CVE-2026-82181

Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote

历史摘要 · 未重新核验 · NVD

#cve #cwe-598

漏洞预警2026-08-28 发布INFO

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insuffic...

CVE-2026-76179

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication

历史摘要 · 未重新核验 · NVD

#cve #cwe-598

漏洞预警2026-08-19 发布INFO

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBear...

CVE-2026-63408

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-598

安全公告2026-08-11 发布INFO

When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's...

CVE-2026-66832

When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is app

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-598 #severity:medium

漏洞预警2026-08-11 发布INFO

When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persi...

CVE-2026-66832

When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is app

历史摘要 · 未重新核验 · NVD

#cve #cwe-598

漏洞预警2026-07-28 发布INFO

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL (Referer,...

CVE-2026-47768

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-

历史摘要 · 未重新核验 · NVD

#cve #cwe-598

安全公告2026-07-28 发布INFO

nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)

CVE-2026-47768

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-598

安全公告2026-07-17 发布INFO

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive...

CVE-2026-15322

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-598 #severity:high

漏洞预警2026-07-17 发布INFO

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the exposure of session tokens in URLs.

CVE-2026-15322

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the

历史摘要 · 未重新核验 · NVD

#cve #cwe-598