#cwe-862

共收录 4228 条相关情报。

漏洞预警2026-07-29 发布INFO

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the MB Frontend Submission extension in versions up to, and ...

CVE-2026-14488

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-29 发布INFO

Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their as...

CVE-2026-50622

Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoi

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-29 发布INFO

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage ide...

CVE-2026-18201

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discov

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-29 发布INFO

The PayU CommercePro Plugin WordPress plugin through 3.8.9 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers ...

CVE-2026-13692

The PayU CommercePro Plugin WordPress plugin through 3.8.9 does not verify the payment-gateway signature before applying

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-29 发布INFO

The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_all_data() function in all versions up to, a...

CVE-2026-5626

The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability chec

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

安全公告2026-07-29 发布INFO

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event...

CVE-2026-17166

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:medium

漏洞预警2026-07-29 发布INFO

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up...

CVE-2026-17166

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-28 发布INFO

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did...

CVE-2026-54719

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863

安全公告2026-07-28 发布INFO

goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)

CVE-2026-54719

GHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes (PUT/POST upload/?mkdir/?delete)

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-862 #cwe-863 #severity:high

安全公告2026-07-28 发布INFO

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass...

CVE-2026-16184

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafte

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:high

漏洞预警2026-07-28 发布INFO

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request.

CVE-2026-16184

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafte

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-28 发布INFO

Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-operator CA scoping employed by ...

CVE-2026-49258

Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

安全公告2026-07-28 发布INFO

Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

CVE-2026-49258

Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-639 #cwe-862

漏洞预警2026-07-28 发布INFO

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request ...

CVE-2026-66751

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to ar

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-28 发布INFO

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protecte...

CVE-2026-66750

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to dow

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

安全公告2026-07-28 发布INFO

Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room

CVE-2026-66751

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to ar

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

安全公告2026-07-28 发布INFO

Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route

CVE-2026-66750

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to dow

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

漏洞预警2026-07-28 发布INFO

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is due to the wpcs_s...

CVE-2026-16774

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-28 发布INFO

The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to authorization bypass in all ve...

CVE-2026-15411

The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-28 发布INFO

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7...

CVE-2026-15025

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to

历史摘要 · 未重新核验 · NVD

#cve #cwe-862