#cwe-639

共收录 1909 条相关情报。

漏洞预警2026-08-24 发布INFO

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with thir...

CVE-2026-71507

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account w

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-24 发布INFO

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with ...

CVE-2026-71505

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site accou

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-08-24 发布INFO

Label Studio does not scope the annotation detail endpoint to the requesting user's organization....

CVE-2026-76073

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:high

漏洞预警2026-08-24 发布INFO

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotation.objec...

CVE-2026-76073

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-24 发布INFO

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accoun...

CVE-2026-77995

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0 - The manipulation of

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-24 发布INFO

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another com...

CVE-2026-78365

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 all

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-08-24 发布INFO

Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.

CVE-2026-78278

Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-24 发布HIGH

Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to th...

CVE-2026-78203

CVE-2026-78203 是 Ghostwriter 报告协作平台中一个已修复的访问控制缺陷，影响 7.1.2 之前的版本。该漏洞位于报告模板替换（swap）端点，服务端未能校验模板归属权，导致低权限攻击者能够将其他客户端（客户）作用域

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-24 发布INFO

A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Han...

CVE-2026-78160

A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing o

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

安全公告2026-08-24 发布INFO

Dolibarr ERP User Notes note.php authorization

CVE-2026-78160

A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing o

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-285 #cwe-639

漏洞预警2026-08-23 发布INFO

A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /boarde...

CVE-2026-78144

A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vuln

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

漏洞预警2026-08-23 发布INFO

A vulnerability was found in code-projects Barangay Resident Profiling Management System 1.0. This impacts an unknown function of the file /archived_records.php of the component...

CVE-2026-78142

A vulnerability was found in code-projects Barangay Resident Profiling Management System 1.0. This impacts an unknown fu

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-639

安全公告2026-08-23 发布INFO

Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions...

CVE-2026-77116

Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5. Any logged-

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

漏洞预警2026-08-23 发布INFO

Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — ...

CVE-2026-77116

Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5. Any logged-

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

安全公告2026-08-21 发布INFO

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0...

CVE-2026-67360

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:medium

安全公告2026-08-21 发布INFO

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20,...

CVE-2026-67359

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauth

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:high

漏洞预警2026-08-21 发布INFO

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream...

CVE-2026-62283

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 t

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-08-21 发布INFO

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's o...

CVE-2026-67360

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-21 发布INFO

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any order_id as a query pa...

CVE-2026-67359

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauth

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-08-21 发布INFO

Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token could increme...

CVE-2026-67358

Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-639