Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gains access to the stored credential could recover the password and obtain an administrative REST access token.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gains access to the stored credential could recover the password and obtain an administrative REST access token.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki