#cwe-639

共收录 1909 条相关情报。

← 返回所有主题

漏洞预警2026-09-04 发布INFO

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or atta...

CVE-2026-16281

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listin

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-04 发布INFO

A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affects some unknown pr...

CVE-2026-85381

A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a061

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

安全公告2026-09-04 发布INFO

Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows...

CVE-2026-83711

Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:critical

安全公告2026-09-04 发布INFO

Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker...

CVE-2026-69857

Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing ov

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:high

漏洞预警2026-09-03 发布INFO

A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthCon...

CVE-2026-85378

A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

漏洞预警2026-09-03 发布INFO

Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-83711

Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-03 发布INFO

Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network.

CVE-2026-69857

Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing ov

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-09-03 发布INFO

SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath

CVE-2026-72802

**CVE:** This vulnerability corresponds to [CVE-2026-72802](https://nvd.nist.gov/vuln/detail/CVE-2026-72802). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-639 #severity:medium

安全公告2026-09-03 发布INFO

ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree

CVE-2026-63669

## Summary ApostropheCMS enforces per-type authorization on pages: a page type may declare `editRole` / `publishRole` (a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-639 #cwe-862 #severity:medium

漏洞预警2026-09-03 发布INFO

Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions f...

CVE-2026-85392

Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-03 发布INFO

Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data....

CVE-2026-85389

Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-09-03 发布INFO

Peppermint through 0.5.5 Authorization Bypass on the User Logout Endpoint

CVE-2026-85392

Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

安全公告2026-09-03 发布INFO

Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints

CVE-2026-85389

Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

漏洞预警2026-09-03 发布INFO

Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue...

CVE-2026-85308

Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrect

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-03 发布INFO

Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.

CVE-2026-84836

Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-03 发布INFO

Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.

CVE-2026-84769

Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-03 发布INFO

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal ow...

CVE-2026-75035

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user,

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-03 发布INFO

vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request bo...

CVE-2026-85214

vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-03 发布INFO

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can access other tenants' cloud storage ...

CVE-2026-85211

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endp

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-03 发布INFO

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account...

CVE-2026-85182

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated cal

历史摘要 · 未重新核验 · NVD

#cve #cwe-639