#cwe-863

共收录 2118 条相关情报。

漏洞预警2026-08-19 发布INFO

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, `GET /api/v1/apps/{app_id}/invoke/presign` grants Azure Blob Storage SAS credentials with writ...

CVE-2026-50173

Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, `GET /api/v1/apps/{app_id}/invoke/pre

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-19 发布INFO

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/{user_id} in api/api/contro...

CVE-2026-41424

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 an

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-19 发布INFO

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user wi...

CVE-2026-44252

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, W

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-19 发布INFO

Dell Command Update (DCU), versions prior to 5.7.1, contain an Incorrect Authorization vulnerability. A low privileged attacker with local access could potentially exploit this ...

CVE-2026-67266

Dell Command Update (DCU), versions prior to 5.7.1, contain an Incorrect Authorization vulnerability. A low privileged a

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-19 发布INFO

stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint that allows authenticated attackers with write credentials...

CVE-2026-76238

stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint t

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-19 发布INFO

The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the da...

CVE-2026-49431

The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-19 发布INFO

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges.

CVE-2026-70408

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has adm

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-18 发布INFO

Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/ap...

CVE-2026-19670

Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restri

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-18 发布INFO

Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermission(role_id), which allowed either...

CVE-2026-55163

Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-18 发布INFO

Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flask_principal.Permission.init...

CVE-2026-48508

Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/aut

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-18 发布INFO

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated use...

CVE-2026-61574

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list r

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-863

漏洞预警2026-08-18 发布INFO

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A use...

CVE-2026-45122

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissio

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-18 发布INFO

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to...

CVE-2026-45121

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistentl

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-18 发布INFO

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file...

CVE-2026-70657

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-18 发布INFO

SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the...

CVE-2026-74906

SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints tha

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

安全公告2026-08-18 发布INFO

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate...

CVE-2026-9816

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:high

安全公告2026-08-18 发布INFO

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce...

CVE-2026-9859

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles o

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:medium

安全公告2026-08-18 发布INFO

This vulnerability only affects Grafana stacks configured with multiple organizations; single...

CVE-2026-11817

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:medium

漏洞预警2026-08-17 发布INFO

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows...

CVE-2026-9859

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles o

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-08-17 发布INFO

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths which allo...

CVE-2026-9816

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields

历史摘要 · 未重新核验 · NVD

#cve #cwe-863