110730 matches found
secdim-assurance-drift-challenge
أداة بناء تحديات SecDim Repro — انحراف الضمانات إعادة إنتاج عملية لتحدٍّ أمني مقترح مستوحى من CVE-2026-88861 ، المنشور في 10 سبتمبر 2026. المفهوم الأمني يتحقق التطبيق بشكل صحيح من جلسة موقّعة، ويتحقق بشكل صحيح من دور admin، لكنه يدمج خاصيتين أمنيتين مستقلتين: الهوية/الدور وضمان المصادقة. يمكن لجل...
CVE-2026-104116
A missing authorization check in the illumos zones statistics daemon zonestatd allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsdserver in usr/src/cmd/zonestat/zonestatd/zonestatd.c, handles the...
CVE-2026-104117
A missing authorization check in the illumos IP management daemon ipmgmtd allows a local user to change the persistent IP multipathing IPMP configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c does not require the solaris.network.interface.config...
EUVD-2026-95885
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/uuid. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete skips the...
CVE-2026-108112
The ruoyi-ai software, versions 3.0.0 through 3.1.0 , is vulnerable to a missing authorization flaw (CWE-862). Authenticated users can delete workflows belonging to other users via the POST /workflow/del/{uuid} endpoint. The root cause is that the softDelete() function fails to invoke the Privile...
CVE-2026-108112 ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/uuid. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete skips the...
EUVD-2026-95884
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or ispublic filtering, to list enabled private workflows in the sa...
CVE-2026-108111 ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or ispublic filtering, to list enabled private workflows in the sa...
CVE-2026-108111
The software ruoyi-ai versions 3.0.0 through 3.1.0 is vulnerable to a missing authorization vulnerability in the GET /workflow/search endpoint. The root cause is a lack of owner or is_public filtering, allowing authenticated non-admin users to query and list enabled private workflows within the s...
CVE-2026-108111 ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or ispublic filtering, to list enabled private workflows in the sa...
CVE-2026-108110 MOVO through 0.2.3 Authorization Bypass via Document Endpoints
MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...
EUVD-2026-95883
MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...
CVE-2026-108110
The MOVO application (versions through 0.2.3 ) contains an authorization bypass vulnerability within the chat-api document endpoints. The root cause allows authenticated users to access other users' stored objects by supplying arbitrary object paths . Specifically, an attacker who knows a target'...
CVE-2026-104116 Missing authorization in illumos zonestatd allows local users to disrupt zonestat and enumerate running zones
A missing authorization check in the illumos zones statistics daemon zonestatd allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsdserver in usr/src/cmd/zonestat/zonestatd/zonestatd.c, handles the...
EUVD-2026-95800
A missing authorization check in the illumos zones statistics daemon zonestatd allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsdserver in usr/src/cmd/zonestat/zonestatd/zonestatd.c, handles the...
CVE-2026-104116 Missing authorization in illumos zonestatd allows local users to disrupt zonestat and enumerate running zones
A missing authorization check in the illumos zones statistics daemon zonestatd allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsdserver in usr/src/cmd/zonestat/zonestatd/zonestatd.c, handles the...
CVE-2026-104116
A missing authorization check in the illumos zones statistics daemon (zonestatd) allows an unprivileged local user in any zone to disrupt zonestat in other zones and enumerate running zones. The vulnerability resides in the zsd_server() procedure within usr/src/cmd/zonestat/zonestatd/zonestatd.c,...
CVE-2026-104117 Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership
A missing authorization check in the illumos IP management daemon ipmgmtd allows a local user to change the persistent IP multipathing IPMP configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c does not require the solaris.network.interface.config...
CVE-2026-104117
A missing authorization check in the illumos IP management daemon (ipmgmtd ) allows an unprivileged local user to modify the persistent IP multipathing (IPMP) configuration. Specifically, the door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c fails to require solaris.network.in...
EUVD-2026-95798
A missing authorization check in the illumos IP management daemon ipmgmtd allows a local user to change the persistent IP multipathing IPMP configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c does not require the solaris.network.interface.config...