#cwe-639

共收录 1909 条相关情报。

漏洞预警2026-09-29 发布INFO

Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and del...

CVE-2026-101112

Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpA

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-29 发布INFO

A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Med...

CVE-2026-102261

A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/ca

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

安全公告2026-09-29 发布INFO

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their...

CVE-2026-97685

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an author

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:high

安全公告2026-09-29 发布INFO

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the...

CVE-2026-102373

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in t

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:high

漏洞预警2026-09-29 发布HIGH

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifie...

CVE-2026-97685

CVE-2026-97685 是 LimeSurvey Community Edition 7.3.0 中的一个对象级授权缺陷（越权 / 跨租户 IDOR，业内通常归类为 BOLA）。具备“创建问卷”权限的已认证用户，可以在 REST 的问

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-29 发布INFO

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequenti...

CVE-2026-102373

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in t

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-28 发布INFO

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including...

CVE-2026-93538

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cl

历史摘要 · 未重新核验 · NVD

#cve #cwe-290 #cwe-639

安全公告2026-09-28 发布INFO

Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet

CVE-2026-93538

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cl

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-290 #cwe-639

漏洞预警2026-09-28 发布INFO

Authorization bypass through User-Controlled key vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows Exploitation of Trusted Identifiers. This issue af...

CVE-2026-82323

Authorization bypass through User-Controlled key vulnerability in Enocta Educational Technologies Inc. Enocta Platform a

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-28 发布INFO

Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or delete resources bel...

CVE-2026-82348

Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring righ

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-09-28 发布INFO

Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups

CVE-2026-82348

Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring righ

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

漏洞预警2026-09-28 发布INFO

A security vulnerability has been detected in fuzui StudentInfo up to fcc42a639ec7cef620651bfd0f07ebb660529e3f. The impacted element is an unknown function of the file /StudentI...

CVE-2026-100897

A security vulnerability has been detected in fuzui StudentInfo up to fcc42a639ec7cef620651bfd0f07ebb660529e3f. The impa

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

漏洞预警2026-09-27 发布INFO

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the com...

CVE-2026-100885

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webku

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

安全公告2026-09-27 发布INFO

Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization

CVE-2026-100885

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webku

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-285 #cwe-639

安全公告2026-09-27 发布INFO

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint,...

CVE-2026-101084

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticat

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:critical

漏洞预警2026-09-27 发布INFO

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they poss...

CVE-2026-101084

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticat

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-27 发布INFO

A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/java/com/edu/common...

CVE-2026-100878

A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.is

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

安全公告2026-09-27 发布INFO

obot before v0.21.1 Authorization Bypass via /mcp-connect

CVE-2026-101084

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticat

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-09-27 发布INFO

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in...

CVE-2026-101033

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operati

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

漏洞预警2026-09-27 发布INFO

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs f...

CVE-2026-101033

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operati

历史摘要 · 未重新核验 · NVD

#cve #cwe-639