#cwe-862

共收录 4122 条相关情报。

漏洞预警2026-09-15 发布INFO

Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced obj...

CVE-2026-91846

Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whethe

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862

漏洞预警2026-09-15 发布INFO

Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path. The vulnerable logic checked whether the acting user could use a sharing_g...

CVE-2026-91825

Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path. The vulnerable lo

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-14 发布INFO

An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window (milliseconds to seconds)...

CVE-2026-77191

An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricte

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-14 发布INFO

IBM Cloud Pak for Business Automation could allow a remote attacker to bypass authorization and invoke restricted endpoints due to improper validation of HTTP headers.

CVE-2026-12758

IBM Cloud Pak for Business Automation could allow a remote attacker to bypass authorization and invoke restricted endpoi

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

安全公告2026-09-14 发布INFO

ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

CVE-2026-56668

### Summary A vulnerability in ZITADEL’s OAuth2 Token Exchange endpoint allows an authenticated user or client to excha

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-862 #severity:high

漏洞预警2026-09-14 发布INFO

A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecorator.onListTasks of the file server...

CVE-2026-90820

A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function Authorizat

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863

漏洞预警2026-09-14 发布INFO

In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not enforce page-property, page-template, or page-type authorization. A...

CVE-2026-81901

In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not enforce pa

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-14 发布INFO

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an exten...

CVE-2026-53718

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-14 发布INFO

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. A malic...

CVE-2026-43689

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-14 发布INFO

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader throug...

CVE-2026-54629

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtu

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73 #cwe-284 #cwe-552 #cwe-862

漏洞预警2026-09-14 发布INFO

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without rest...

CVE-2026-50006

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL fro

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73 #cwe-284 #cwe-434 #cwe-862

漏洞预警2026-09-14 发布INFO

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability.

CVE-2026-16190

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-13 发布CRITICAL

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke admin...

CVE-2026-81648

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX

来源摘录 · NVD

#cve #cwe-862

安全公告2026-09-12 发布INFO

A deployment mode intended to expose only read access to a bundled packet-analysis component's...

CVE-2026-90454

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list o

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:medium

安全公告2026-09-12 发布INFO

A deployment mode intended to expose only read access to stored data proxies a set of application...

CVE-2026-90448

A deployment mode intended to expose only read access to stored data proxies a set of application programming interface

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:high

漏洞预警2026-09-11 发布INFO

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits ...

CVE-2026-90454

CVE-2026-90454 是一个访问控制绕过漏洞，影响一个捆绑的包分析组件的部署模式。该部署模式的设计意图是仅暴露对组件接口的读取权限，并通过模式匹配的方式拒绝一系列具有写入能力的路由。然而，该模式匹配列表遗漏了用于修改存储在会话记录上

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-11 发布MEDIUM

A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allo...

CVE-2026-90448

该漏洞存在于一种被设计为『仅暴露存储数据读取能力』的部署模式中。实现该模式时，产品将一组后端 API 路由直接代理给调用方，但只关注了业务语义上的『只读』，并未在传输层对允许的 HTTP 请求方法施加白名单限制。在这批被代理的路由里，有一条

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

安全公告2026-09-11 发布INFO

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block...

CVE-2026-68535

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's vali

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-862 #severity:medium

安全公告2026-09-11 发布INFO

Shopper: Missing authorization on product removal actions in CollectionProducts component

CVE-2026-56825

## Title Missing authorization on product removal actions in CollectionProducts component ## Description A lack of au

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-862 #severity:high

安全公告2026-09-11 发布INFO

Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)

CVE-2026-56830

## Title Missing authorization on Media sub-form store action allows unpermissioned product media update ## Descriptio

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-862 #severity:medium