#cwe-862

共收录 4122 条相关情报。

← 返回所有主题

漏洞预警2026-08-28 发布INFO

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileg...

CVE-2026-55547

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-862

漏洞预警2026-08-28 发布INFO

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. Pac...

CVE-2026-55545

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-28 发布INFO

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop...

CVE-2026-55521

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPac

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-28 发布INFO

Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from i...

CVE-2026-55064

Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-28 发布INFO

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does not verify that a...

CVE-2026-54746

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

安全公告2026-08-28 发布INFO

SpringBlade 2.7.3 < 5.0.0 Privilege Escalation via Exposed Feign Endpoint

CVE-2026-56100

SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows a

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

漏洞预警2026-08-28 发布INFO

Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.

CVE-2026-81767

Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-28 发布INFO

Subscriber Broken Access Control in WpEvently <= 5.5.0 versions.

CVE-2026-81761

Subscriber Broken Access Control in WpEvently <= 5.5.0 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-28 发布INFO

Contributor Broken Access Control in WpEvently <= 5.5.0 versions.

CVE-2026-81759

Contributor Broken Access Control in WpEvently <= 5.5.0 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-28 发布INFO

Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions.

CVE-2026-81284

Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-28 发布INFO

Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline to...

CVE-2026-82245

Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authentic

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-28 发布INFO

Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, ...

CVE-2026-82242

Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpo

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-28 发布INFO

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to gran...

CVE-2026-82240

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoi

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-28 发布INFO

Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or d...

CVE-2026-82239

Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowin

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

安全公告2026-08-28 发布INFO

Budibase before 3.41.3 Missing Authorization License Management

CVE-2026-82245

Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authentic

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

安全公告2026-08-28 发布INFO

Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization

CVE-2026-82242

Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpo

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

安全公告2026-08-28 发布INFO

Budibase before 3.41.3 Privilege Escalation via User Update API

CVE-2026-82240

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoi

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

安全公告2026-08-28 发布INFO

Budibase before 3.41.3 Authorization Bypass via datasources/query

CVE-2026-82239

Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowin

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

漏洞预警2026-08-28 发布INFO

The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund...

CVE-2026-77701

The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns t

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-08-28 发布INFO

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is regist...

CVE-2026-12514

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capab

历史摘要 · 未重新核验 · NVD

#cve #cwe-862