#cwe-918

共收录 2042 条相关情报。

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.39.0, the executeQuery automation step in Budibase accepts a queryId from automation step inputs and passes it directly ...

CVE-2026-48128

Budibase is an open-source low-code platform. Prior to 3.39.0, the executeQuery automation step in Budibase accepts a qu

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.38.1, the REST datasource integration (packages/server/src/integrations/rest.ts) follows HTTP redirects without re-check...

CVE-2026-45715

Budibase is an open-source low-code platform. Prior to 3.38.1, the REST datasource integration (packages/server/src/inte

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.34.8, the processUrlFile function in packages/server/src/automations/steps/ai/extract.ts uses fetch(fileUrl) directly wi...

CVE-2026-45548

Budibase is an open-source low-code platform. Prior to 3.34.8, the processUrlFile function in packages/server/src/automa

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-27 发布INFO

Budibase is an open-source low-code platform. Prior to 3.35.10, the Plugin URL upload endpoint (POST /api/plugin) validates the submitted URL with a single substring check: url....

CVE-2026-45061

Budibase is an open-source low-code platform. Prior to 3.35.10, the Plugin URL upload endpoint (POST /api/plugin) valida

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-05-27 发布INFO

Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.

CVE-2026-48916

Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918 #severity:medium

漏洞预警2026-05-27 发布INFO

Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.

CVE-2026-48918

Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-27 发布INFO

Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.

CVE-2026-48916

Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-27 发布INFO

GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using...

CVE-2026-44971

GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scannin

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-27 发布INFO

Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri's is_local_url() function causes it to incorrectly classify remot...

CVE-2026-42184

Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri's is_loc

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-05-27 发布INFO

A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server...

CVE-2026-9312

A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenti

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918 #severity:critical

安全公告2026-05-27 发布INFO

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server...

CVE-2026-8606

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker t

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918 #severity:high

漏洞预警2026-05-27 发布INFO

A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to send crafted requests to internal servi...

CVE-2026-9312

A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenti

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-27 发布INFO

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP requests to internal ser...

CVE-2026-8606

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker t

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-26 发布INFO

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy (the documented quickstart, no DOZZLE_AUTH_PROVIDER set), POST /api/notificati...

CVE-2026-45298

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy (the documented quick

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-26 发布INFO

MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.1, SSRF via work_flow_template Import. Authenticated users can supply arbitrary URLs in work_flow_template.down...

CVE-2026-45412

MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.1, SSRF via work_flow_template Import. Authenticated u

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-26 发布INFO

MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch functi...

CVE-2026-42336

MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a server-side request forge

历史摘要 · 未重新核验 · NVD

#cve #cwe-367 #cwe-918

漏洞预警2026-05-26 发布INFO

MaxKB is an open-source AI assistant for enterprise. Prior to 2.8.1, MaxKB v2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service...

CVE-2026-42335

MaxKB is an open-source AI assistant for enterprise. Prior to 2.8.1, MaxKB v2.8.0 and prior are vulnerable to a server-s

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-26 发布INFO

Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsing. The original v...

CVE-2026-44502

Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be (partially) bypa

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-26 发布INFO

A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate service account acc...

CVE-2026-2264

A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-26 发布INFO

IBM webMethods Integration (on prem) -Integration Server 10.15 through IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10 IBM webMethods Integration is vulnerable to server-side requ...

CVE-2025-14290

IBM webMethods Integration (on prem) -Integration Server 10.15 through IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10 IBM

历史摘要 · 未重新核验 · NVD

#cve #cwe-918