#cwe-863

共收录 2104 条相关情报。

漏洞预警2026-09-28 发布INFO

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::change_password(), was add...

CVE-2026-100371

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-28 发布INFO

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC ...

CVE-2026-101914

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1

历史摘要 · 未重新核验 · NVD

#cve #cwe-187 #cwe-863

安全公告2026-09-28 发布INFO

@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

CVE-2026-101914

### Impact When using RBAC to apply authentication rules, the exact path (method name) matcher applies a prefix match in

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-187 #cwe-863 #severity:medium

漏洞预警2026-09-28 发布INFO

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Inv...

CVE-2026-101139

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /ad

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863

漏洞预警2026-09-28 发布INFO

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the under...

CVE-2026-86102

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access t

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-863

漏洞预警2026-09-28 发布INFO

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authentica...

CVE-2026-97335

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

安全公告2026-09-28 发布INFO

Incorrect authorization in LXD storage volume API allows reading volumes from other projects

CVE-2026-97335

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

漏洞预警2026-09-28 发布INFO

An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authen...

CVE-2026-19759

An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prio

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-28 发布INFO

Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding request token for a c...

CVE-2026-82378

Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

安全公告2026-09-28 发布INFO

Apache Roller: OAuth authorization endpoint trusts request-supplied identity

CVE-2026-82378

Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

漏洞预警2026-09-28 发布INFO

A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function get_expense_claims/get_shift_requests/get_attendance_requests of the file hrms/api/__in...

CVE-2026-101006

A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function get_expense_claims/get_shift_r

历史摘要 · 未重新核验 · NVD

#cve #cwe-285 #cwe-863

漏洞预警2026-09-28 发布INFO

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.json of the component...

CVE-2026-101000

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /u

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863

安全公告2026-09-27 发布INFO

Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION...

CVE-2026-101062

Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dyn

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:high

漏洞预警2026-09-27 发布INFO

Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dynamic client registration without authentication and witho...

CVE-2026-101062

Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dyn

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-27 发布INFO

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the component dataS...

CVE-2026-100879

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed o

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863

安全公告2026-09-27 发布INFO

Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration

CVE-2026-101062

Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dyn

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

安全公告2026-09-27 发布INFO

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state...

CVE-2026-101056

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:medium

安全公告2026-09-27 发布INFO

Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node...

CVE-2026-101048

Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:medium

漏洞预警2026-09-27 发布INFO

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access can repl...

CVE-2026-101056

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID.

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-27 发布INFO

Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the Admin.W...

CVE-2026-101048

Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/

历史摘要 · 未重新核验 · NVD

#cve #cwe-863