@jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture
CVE-2026-92299
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMe
#cwe-862
共收录 4087 条相关情报。
← 返回所有主题The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS...
CVE-2026-82567
The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a conn
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged...
CVE-2026-73807
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthentica
The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over the netw...
CVE-2026-82567
The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a conn
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API coul...
CVE-2026-73807
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthentica
Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a...
CVE-2026-91739
Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had
Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote...
CVE-2026-91732
Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromis
Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a...
CVE-2026-91717
Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtai
Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements vi...
CVE-2026-91739
Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had
Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering ...
CVE-2026-91732
Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromis
Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium...
CVE-2026-91717
Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtai
Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HT...
CVE-2026-91713
Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised t
The affected products are missing authorization on state-changing CGIs and session checks are not performed.
CVE-2026-66887
The affected products are missing authorization on state-changing CGIs and session checks are not performed.
Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token va...
CVE-2026-18426
Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control
Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global access_sitemap task permi...
CVE-2026-18425
Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\Sitem
Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action (Backend\Pa...
CVE-2026-18422
Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in th
In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the per-page CSRF tok...
CVE-2026-81923
In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving
Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the send_to_top and...
CVE-2026-81922
Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the
Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token ...
CVE-2026-81921
Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, w
Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permission, which was onl...
CVE-2026-68533
Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluatin