Azure-APIM-Cross-Tenant-Signup-Bypass

Azure APIM 跨租户注册绕过 状态（2025年12月1日）： 该漏洞仍然存在且可被利用。Microsoft 尚未修复此问题，并认为其“设计使然”。 安全公告 GHSA-vcwf-73jp-r7mv CVE-2025-66390 摘要 Azure API 管理（APIM）开发者门户中的一个安全漏洞允许攻击者在任何启用了基本身份验证的 APIM 实例上注册账户，即使管理员已在门户界面中禁用了用户注册。 该绕过可实现跨租户账户创建，从而可能允许未经授权访问 API 文档、订阅密钥以及通过开发者门户公开的其他资源。 披露时间线 日期| 操作 ---|--- 2025-09-30| 发现漏...

dirty_sock

dirtysock: Linux 権限昇格 snapd 経由 2019年1月、当時の Ubuntu Linux の現行バージョンが snapd API のバグによりローカル権限昇格の脆弱性の影響を受けることが判明しました。このリポジトリには、研究および教育用に公開されているオリジナルのエクスプロイト POC が含まれています。脆弱性とエクスプロイトの詳細なウォークスルーについては、 こちらのブログ投稿を参照してください。 Ubuntu には snapd...

CVE-2026-35616

🚨 CVE-2026-35616 - FortiClient EMS 認証バイパス 🚨 不適切なアクセス制御 | 事前認証 API バイパス 実環境で悪用 — 2026年4月 📋 概要 CVE-2026-35616 は、FortiClient Enterprise Management Server EMS バージョン 7.4.5 から 7.4.6 における重大な脆弱性です。 認証されていないリモート攻撃者が特別に細工したリクエストを送信することで、認証および認可のチェックをバイパスし、不正なコード実行やサーバー全体の侵害につながる可能性があります。 Fortinet アドバイザリ :...

CVE-2015-3073

CVE-2015-3073 此漏洞允许远程攻击者绕过 Adobe Reader 受安装版本中的 API 限制。利用此漏洞需要用户交互，即目标必须访问恶意页面或打开恶意文件。 具体缺陷存在于 AFParseDate 中。通过创建包含特定 JavaScript 指令的特制 PDF，可以绕过 JavaScript API 限制。远程攻击者可利用此漏洞执行任意代码。 Windows 和 OS X 上，Adobe Reader 和 Acrobat 10.1.14 之前的 10.x 版本以及 11.0.11 之前的 11.x 版本受此漏洞影响。 注意： 代码假设你已将名为 exploit.txt 的...

EUVD-2026-87691

Froxlor through 2.3.10 does not enforce the mail.allowexternaldomains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains mail.enableallowsender = 1, mail.allowexternaldomains = 0, an authenticated...

CVE-2026-78153

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...

EUVD-2026-70042

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...

PT-2026-84715

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

GHSA-8W8C-8MX9-52CW Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

Impact When Full Multiple Companies Support and scopelocationsfmcs are both enabled, the API endpoint for creating locations can still create a child location under a parent location from a different company. The code detects the invalid parent/child company mismatch, but it appears not to return...

Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

Impact When Full Multiple Companies Support and scopelocationsfmcs are both enabled, the API endpoint for creating locations can still create a child location under a parent location from a different company. The code detects the invalid parent/child company mismatch, but it appears not to return...

CVE-2026-17559

Passster (Content Protector) WordPress plugin versions before 4.3.9 contain an unauthenticated information disclosure vulnerability in its REST API path allowlist logic. The plugin compares its own public endpoint paths as an unanchored substring of the request URI rather than against the resolve...

Mattermost Server 10.11.x < 10.11.22 / 11.7.x < 11.7.7 Multiple Vulnerabilities (MMSA-2026-00672, MMSA-2026-00675, MMSA-2026-00704)

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities as referenced in the MMSA-2026-00672, MMSA-2026-00675, MMSA-2026-00704 advisories. - Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to prevent guest users from receiving Board Admin...

CVE-2026-19709 Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...

CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions

Email Management API Bypasses ManageCredentials Feature Restrictions...

CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions

Email Management API Bypasses ManageCredentials Feature Restrictions...

PT-2026-71700

Name of the Vulnerable Software and Affected Versions Email Management API affected versions not specified Description The Email Management API contains a flaw that allows the bypass of restrictions within the ManageCredentials feature. Recommendations At the moment, there is no information about...

PT-2026-71018

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups...

CVE-2026-69117 NetBox 4.5.8 ORM Injection via WritableNestedSerializer

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any RES...

CVE-2026-69115 OpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration Endpoints

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/getusers, /user/getallusersuid, and /group/getgroups. Attackers can exploit th...

CVE-2026-69115

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/getusers, /user/getallusersuid, and /group/getgroups. Attackers can exploit th...