#cwe-639

共收录 1909 条相关情报。

漏洞预警2026-09-19 发布INFO

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/...

CVE-2026-93955

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the functio

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

安全公告2026-09-19 发布INFO

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does...

CVE-2026-92421

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the hos

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

安全公告2026-09-19 发布INFO

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not...

CVE-2026-91847

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester ow

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

安全公告2026-09-19 发布INFO

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does...

CVE-2026-92425

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-leve

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

安全公告2026-09-19 发布INFO

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does...

CVE-2026-92420

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booki

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:low

漏洞预警2026-09-19 发布INFO

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management ...

CVE-2026-92425

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-leve

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-19 发布INFO

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the re...

CVE-2026-92421

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the hos

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-19 发布INFO

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or del...

CVE-2026-92420

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booki

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-19 发布INFO

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its una...

CVE-2026-91847

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester ow

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-09-19 发布INFO

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to...

CVE-2026-89333

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Refere

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

漏洞预警2026-09-19 发布INFO

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the '...

CVE-2026-89333

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Refere

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-18 发布INFO

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/{id} in PoolClueController.ge...

CVE-2026-76901

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior t

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-18 发布INFO

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscri...

CVE-2026-63647

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior t

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-639

漏洞预警2026-09-18 发布INFO

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploade...

CVE-2026-81182

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-18 发布INFO

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem...

CVE-2026-77385

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-09-18 发布INFO

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply a...

CVE-2026-63458

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenti

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-18 发布INFO

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an authenticated user could submit caller-controlled recordIds ...

CVE-2026-62279

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an aut

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-09-18 发布INFO

SysReptor: Unauthorized file disclosure by broken access control in writable shared notes

CVE-2026-81182

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-09-18 发布INFO

Perses's project query parameter authorization bypass exposes cross-project resources

CVE-2026-63458

### Impact _What kind of vulnerability is it?_ An authenticated user who is only a viewer on project team-a requests GE

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-639 #severity:high

安全公告2026-09-18 发布INFO

Perses project query parameter authorization bypass exposes cross-project resources

CVE-2026-63458

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenti

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639