#cwe-862

共收录 4228 条相关情报。

漏洞预警2026-05-12 发布INFO

Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs n...

CVE-2026-44010

Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element res

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-12 发布INFO

Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records...

CVE-2026-5146

Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacke

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-12 发布INFO

Kubewarden is a policy engine for Kubernetes. Prior to , An attacker with privileged AdmissionPolicy or AdmissionPolicyGroup create permissions (which isn't the default) can cra...

CVE-2026-42541

Kubewarden is a policy engine for Kubernetes. Prior to , An attacker with privileged AdmissionPolicy or AdmissionPolicyG

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-12 发布INFO

Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

CVE-2026-35438

Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-12 发布INFO

The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories). The endpoint allows unauthenticated users to submit ...

CVE-2026-31245

The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memori

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-862

漏洞预警2026-05-12 发布INFO

The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories/{memory_id}). The endpoint allows unauthenticated us...

CVE-2026-31244

The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memo

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-862

漏洞预警2026-05-12 发布INFO

The mem0 1.0.0 server lacks authentication and authorization controls for its memory reset and table re-creation functionality accessible via the DELETE /memories endpoint. An u...

CVE-2026-31243

The mem0 1.0.0 server lacks authentication and authorization controls for its memory reset and table re-creation functio

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-862

漏洞预警2026-05-12 发布INFO

The mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset functionality accessible via the DELETE /memories endpoint. An unauthenticated attack...

CVE-2026-31242

The mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset functionality accessible via

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-862

漏洞预警2026-05-12 发布INFO

The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories). The endpoint allows unauthenticated users to delet...

CVE-2026-31241

The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memo

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-862

漏洞预警2026-05-12 发布CRITICAL

A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.0 thr...

CVE-2026-26083

A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, Fo

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-05-12 发布INFO

Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recover...

CVE-2026-8407

Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no add

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-12 发布INFO

Missing Authorization vulnerability in WPMU DEV Hustle allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hustle: through 7.8.10.1.

CVE-2026-25431

Missing Authorization vulnerability in WPMU DEV Hustle allows Exploiting Incorrectly Configured Access Control Security

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

安全公告2026-05-12 发布INFO

Due to insufficient authorization checks in the SAP Incentive and Commission Management...

CVE-2026-40134

Due to insufficient authorization checks in the SAP Incentive and Commission Management application, authenticated users

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:medium

安全公告2026-05-12 发布INFO

Due to missing authorization check in SAP Strategic Enterprise Management (Scorecard Wizard in...

CVE-2026-40132

Due to missing authorization check in SAP Strategic Enterprise Management (Scorecard Wizard in Business Server Pages), a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:medium

安全公告2026-05-12 发布INFO

Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated...

CVE-2026-40133

Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated attacker could gain unauthoriz

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:medium

漏洞预警2026-05-12 发布MEDIUM

Due to insufficient authorization checks in the SAP Incentive and Commission Management application, authenticated users could invoke a remote-enabled function module to perform...

CVE-2026-40134

该漏洞存在于SAP激励与佣金管理（Incentive and Commission Management）应用程序中，由于对某个远程启用功能模块的授权检查不足，已通过身份验证的用户可以调用该模块执行数据库表更新操作，从而在未获适当授权的情况

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-12 发布MEDIUM

Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated attacker could gain unauthorized access to view and modify condition table records, res...

CVE-2026-40133

CVE-2026-40133 是 SAP S/4HANA 条件维护（Condition Maintenance）组件中的一个授权缺失漏洞。由于该组件在处理条件表记录时未正确执行授权检查，已通过身份验证的攻击者可以利用此漏洞，以低权限（需要普

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-12 发布MEDIUM

Due to missing authorization check in SAP Strategic Enterprise Management (Scorecard Wizard in Business Server Pages), an authenticated attacker could access information that th...

CVE-2026-40132

CVE-2026-40132 是 SAP Strategic Enterprise Management (Scorecard Wizard in Business Server Pages) 组件中的一个授权缺失漏洞。由于对特定功能（如记

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-11 发布INFO

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call p...

CVE-2026-43885

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read API

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-862

安全公告2026-05-11 发布INFO

MantisBT has a Private Bugnote Attachment Content Leak via REST API

CVE-2026-42071

A missing authorization check in MantisBT's file visibility function allows any authenticated user (REPORTER+) to downlo

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-862 #severity:high