#cwe-915

共收录 137 条相关情报。

漏洞预警2026-07-10 发布INFO

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versio...

CVE-2026-55804

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-07-10 发布INFO

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versio...

CVE-2026-55803

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-07-10 发布INFO

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affect...

CVE-2026-15083

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Cond

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-07-10 发布INFO

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Teal...

CVE-2026-13244

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Ma

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-07-10 发布INFO

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Fiel...

CVE-2026-12535

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field a

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

安全公告2026-07-10 发布INFO

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in...

CVE-2026-9726

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal Alternativ

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-915

漏洞预警2026-07-10 发布INFO

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue af...

CVE-2026-9726

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal Alternativ

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-07-09 发布INFO

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAIL...

CVE-2026-59721

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in ad

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78 #cwe-915

安全公告2026-07-09 发布INFO

Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection

CVE-2026-59721

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in ad

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-77 #cwe-78 #cwe-915

漏洞预警2026-07-07 发布INFO

FastGPT is an open source AI knowledge base platform. From 4.14.17 to before 4.15.0-beta4, FastGPT allows an authenticated tenant user to call POST /api/core/dataset/collection/...

CVE-2026-54601

FastGPT is an open source AI knowledge base platform. From 4.14.17 to before 4.15.0-beta4, FastGPT allows an authenticat

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

安全公告2026-07-07 发布INFO

FastGPT: reTrainingCollection allows server-owned datasetId override causing cross-tenant authorization confusion

CVE-2026-54601

FastGPT is an open source AI knowledge base platform. From 4.14.17 to before 4.15.0-beta4, FastGPT allows an authenticat

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-915

漏洞预警2026-07-06 发布INFO

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, an unauthenticated mass assignment vulnerability in the client self-registration...

CVE-2026-43925

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, an unauthenticated mass

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-07-01 发布INFO

Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config en...

CVE-2026-50160

Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and e

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-06-30 发布INFO

c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC...

CVE-2026-55223

c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can c

历史摘要 · 未重新核验 · NVD

#cve #cwe-502 #cwe-915

漏洞预警2026-06-26 发布INFO

Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body into automat...

CVE-2026-54351

Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly acce

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-06-25 发布INFO

K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com_users`...

CVE-2026-48943

K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by inc

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-06-24 发布INFO

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's sendFile...

CVE-2026-45687

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3,

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

安全公告2026-06-23 发布INFO

jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields

CVE-2026-54516

## Summary `POJOPropertiesCollector._renameProperties()` allows a property with `@JsonProperty("renamed")` on the getter

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #maven #cwe-915 #severity:medium

安全公告2026-06-23 发布INFO

jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

CVE-2026-54515

## Summary In `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #maven #cwe-915 #severity:medium

漏洞预警2026-06-23 发布INFO

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._...

CVE-2026-54516

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From

历史摘要 · 未重新核验 · NVD

#cve #cwe-915