#cwe-639

共收录 1905 条相关情报。

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-...

CVE-2026-104971

Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset witho

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

安全公告2026-10-05 发布INFO

Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

CVE-2026-105639

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for an

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-287 #cwe-639

安全公告2026-10-05 发布INFO

Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)

CVE-2026-105637

Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/vie

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-10-05 发布INFO

Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope

CVE-2026-105633

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-10-05 发布INFO

Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure

CVE-2026-105631

Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownlo

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-10-05 发布INFO

Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup

CVE-2026-105629

Plane is an open-source project management tool. Prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-10-05 发布INFO

Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints

CVE-2026-104975

Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/as

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

漏洞预警2026-10-05 发布INFO

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead ...

CVE-2026-78412

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server che

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the cal...

CVE-2026-104969

Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the re

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied i...

CVE-2026-104967

Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named ...

CVE-2026-104966

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resour

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the c...

CVE-2026-104965

Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads th...

CVE-2026-104964

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller a

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint ...

CVE-2026-104960

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/w

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's wor...

CVE-2026-104894

Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL pat

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-10-05 发布INFO

Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization

CVE-2026-104971

Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset witho

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639 #cwe-862

安全公告2026-10-05 发布INFO

Plane: Cross-Tenant Cycle Issue Hijack via IDOR

CVE-2026-104969

Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the re

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-10-05 发布INFO

Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint

CVE-2026-104967

Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-10-05 发布INFO

Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces

CVE-2026-104966

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resour

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-10-05 发布INFO

Plane: Cross-Tenant Issue Relation Creation via IDOR

CVE-2026-104965

Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639