#cwe-639

共收录 1909 条相关情报。

漏洞预警2026-09-05 发布INFO

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute...

CVE-2026-86191

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint t

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-09-05 发布INFO

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API...

CVE-2026-86176

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, S

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

安全公告2026-09-05 发布INFO

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the...

CVE-2026-86174

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. A

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

安全公告2026-09-05 发布INFO

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint,...

CVE-2026-86111

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:high

安全公告2026-09-05 发布INFO

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and...

CVE-2026-86112

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing auth

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

安全公告2026-09-05 发布INFO

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough...

CVE-2026-86113

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authe

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:high

安全公告2026-09-05 发布INFO

SiYuan before v3.8.2 Information Disclosure via Attribute-View

CVE-2026-86192

SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys end

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-09-05 发布INFO

SiYuan before v3.8.2 Private Attribute View Key Enumeration

CVE-2026-86191

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint t

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

漏洞预警2026-09-05 发布INFO

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with vie...

CVE-2026-86176

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, S

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-05 发布INFO

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary iss...

CVE-2026-86174

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. A

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-09-05 发布INFO

NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs

CVE-2026-86176

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, S

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-09-05 发布INFO

Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board

CVE-2026-86174

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. A

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

漏洞预警2026-09-05 发布INFO

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading records. At...

CVE-2026-86113

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authe

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-05 发布INFO

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-o...

CVE-2026-86112

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing auth

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-05 发布INFO

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message revi...

CVE-2026-86111

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-09-05 发布INFO

BookWyrm through 0.9.1 Insecure Direct Object Reference in edit-readthrough Allows Tampering with Other Users' Reading Records

CVE-2026-86113

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authe

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-09-05 发布INFO

BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints

CVE-2026-86112

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing auth

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-09-05 发布INFO

BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses

CVE-2026-86111

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-09-04 发布INFO

SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

CVE-2026-63735

An authenticated user scoped to one namespace/database could invoke a custom API (`DEFINE API`) belonging to a different

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #rust #cwe-639 #cwe-862 #severity:high

漏洞预警2026-09-04 发布INFO

A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipulation of the argument vId/id causes authorization bypass. ...

CVE-2026-85638

A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipula

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639