#cwe-639

共收录 1909 条相关情报。

← 返回所有主题

漏洞预警2026-08-27 发布INFO

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privi...

CVE-2026-81658

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-27 发布INFO

Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Functionality Not Properly Constrained by ACLs. This issue...

CVE-2026-17562

Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Fu

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-08-27 发布INFO

Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification

CVE-2026-81817

Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue acr

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

漏洞预警2026-08-27 发布INFO

If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An at...

CVE-2026-81576

If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-08-27 发布INFO

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged...

CVE-2026-77035

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Eve

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

安全公告2026-08-27 发布INFO

Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in...

CVE-2026-77990

Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

漏洞预警2026-08-27 发布INFO

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and includin...

CVE-2026-78139

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-27 发布INFO

Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1 - A non-manager can therefore read attendee names, user...

CVE-2026-77990

Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-27 发布INFO

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1 - A registered user with edit-own righ...

CVE-2026-77035

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Eve

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-27 发布INFO

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer p...

CVE-2026-16568

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 doe

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-27 发布INFO

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attacker...

CVE-2026-16567

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-08-26 发布INFO

asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution

CVE-2026-54590

**Incomplete fix for CVE-2026-45309 (GHSA-g794-3fmp-753h).** The 2.23.0 guard that sanitises the SSH username before `

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-22 #cwe-639 #severity:medium

安全公告2026-08-26 发布INFO

Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

CVE-2026-54553

## Summary Affected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-200 #cwe-248 #cwe-602 #cwe-639

漏洞预警2026-08-26 发布MEDIUM

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal sessio...

CVE-2026-77789

CVE-2026-77789 是 WordPress 插件“Stripe Payment Forms by WP Full Pay”中存在的一个逻辑缺陷漏洞，影响 8.5.1 之前的版本。该插件用于在 WordPress 站点上集成 Str

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-26 发布MEDIUM

The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, al...

CVE-2026-74930

The Project Manager WordPress 插件在 4.0.7 版本之前存在一处越权访问漏洞。该插件的一个 REST API 路由在获取用户活动历史时，未校验请求者是否为被查询用户本人，导致任何已认证用户（例如订阅者）都可以

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-26 发布INFO

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, ...

CVE-2026-14212

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated empl

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-26 发布INFO

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing ...

CVE-2026-13404

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (rel

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-26 发布INFO

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users...

CVE-2026-80197

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-08-25 发布INFO

Kimai before 2.57.0 Improper Authorization via Favorite Endpoints

CVE-2026-80197

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639

漏洞预警2026-08-25 发布INFO

TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make typebots on that do...

CVE-2026-62861

TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another work

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862