#cwe-863

共收录 2118 条相关情报。

漏洞预警2026-07-20 发布INFO

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privileg...

CVE-2026-44231

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prio

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-269 #cwe-863

漏洞预警2026-07-20 发布INFO

SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and REL...

CVE-2026-63755

SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses i

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attacker...

CVE-2026-63751

SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT subscriptions where permission expressions referencing $value, $before, $after, or ...

CVE-2026-63749

SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT subscriptions where permis

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.0 contain a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths. Attackers can execute COUNT queries on indexed fields w...

CVE-2026-63742

SurrealDB versions before 3.1.0 contain a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users, leaking denied array elements instead of hiding them. A...

CVE-2026-63740

SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-20 发布INFO

SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with ta...

CVE-2026-63738

SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through g

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-20 发布INFO

SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attacker...

CVE-2026-63733

SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMIS

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-20 发布INFO

The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges s...

CVE-2026-10755

The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-19 发布INFO

A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown function of the component OAuth Credential Revoke Handler. Performing a manipula...

CVE-2026-16215

A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown function of the compone

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863

安全公告2026-07-19 发布INFO

geex-arts django-jet OAuth Credential Revoke authorization

CVE-2026-16215

A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown function of the compone

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862 #cwe-863

安全公告2026-07-17 发布INFO

IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9...

CVE-2026-4938

IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Ident

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:medium

漏洞预警2026-07-17 发布CRITICAL

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<association>? in the UI and...

CVE-2026-55518

Avo 是一个用于 Ruby on Rails 应用创建管理后台的框架。在版本 3.32.1 和 4.0.0.beta.51 之前，Avo 的关联附加工作流在 UI 和 GET /resources/:resource/:id/:relat

历史摘要 · 未重新核验 · NVD

#cve #cwe-639 #cwe-862 #cwe-863

漏洞预警2026-07-17 发布INFO

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controlle...

CVE-2026-54244

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endp

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-17 发布INFO

IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security...

CVE-2026-4938

IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Ident

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

安全公告2026-07-17 发布INFO

SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing...

CVE-2026-63309

SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:medium

安全公告2026-07-17 发布INFO

osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading...

CVE-2026-14871

osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Obje

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:high

漏洞预警2026-07-17 发布INFO

SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to leak the relative ordering of restricted field values. A...

CVE-2026-63309

SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-17 发布INFO

Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint (syncapi/routing/context.go) that allows authenticated local users to ...

CVE-2026-63097

Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint (syncapi/rout

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-17 发布INFO

osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem.

CVE-2026-14871

osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Obje

历史摘要 · 未重新核验 · NVD

#cve #cwe-863