#cwe-639

共收录 1905 条相关情报。

← 返回所有主题

漏洞预警2026-10-30 发布MEDIUM

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuse...

CVE-2026-119657

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend l...

CVE-2026-119652

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by ...

CVE-2026-119651

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allo

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings...

CVE-2026-119650

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows au

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other dep...

CVE-2026-119647

RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept t

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction rep...

CVE-2026-119646

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other s

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access check...

CVE-2026-119645

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated us

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture...

CVE-2026-119644

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to mo

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' confi...

CVE-2026-119598

Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs t

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. ...

CVE-2026-119596

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authentic

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布LOW

Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-...

CVE-2026-119571

Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates address

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布INFO

Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another ...

CVE-2026-119038

Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_fee...

CVE-2026-119555

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an inform

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布LOW

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invo...

CVE-2026-119548

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows user

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownershi...

CVE-2026-119547

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerabili

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布LOW

A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redir...

CVE-2026-59385

A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, en

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-30 发布MEDIUM

A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. ...

CVE-2026-118947

A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core l

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-639 #severity:medium

漏洞预警2026-10-29 发布HIGH

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispatch endpoint accepts attacker-controll...

CVE-2026-61671

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle

来源摘录 · NVD

#cve #cwe-352 #cwe-639

漏洞预警2026-10-29 发布HIGH

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers...

CVE-2026-119325

Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_po

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-29 发布MEDIUM

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether a...

CVE-2026-118760

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.1

来源摘录 · NVD

#cve #cwe-639 #cwe-862