Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply multiple CSS classes that create a…
Opis źródłowy NVD · ENCVSS 3,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
LiteLLM Information health API_KEY Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LiteLLM. Authentication is required to exploit this vulnerability.
The specific flaw exists within the handling of the…
Opis źródłowy NVD · ENCVSS 3,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to gain CSRF tokens by exploiting improper input validation in repository references combined with redirect handling weaknesses.
Opis źródłowy NVD · ENCVSS 3,5 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due…
Opis źródłowy NVD · ENCVSS 3,5 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2507.1, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using the…
Opis źródłowy NVD · ENCVSS 3,5 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
The WP Fastest Cache Premium plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.7.4 via the 'get_server_time_ajax_request' AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web…
Opis źródłowy NVD · ENCVSS 3,5 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to leak sensitive information from confidential issues by injecting hidden prompts into merge request comments.
Opis źródłowy NVD · ENCVSS 3,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Address to be embedded in them. The values cannot be changed later on, so the Apple profile generation page asks for those values and reflects…
Opis źródłowy NVD · ENCVSS 3,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via…
Opis źródłowy NVD · ENCVSS 3,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply multiple CSS classes that create a…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
LiteLLM Information health API_KEY Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LiteLLM. Authentication is required to exploit this vulnerability.
The specific flaw exists within the handling of the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to gain CSRF tokens by exploiting improper input validation in repository references combined with redirect handling weaknesses.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,5 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,5 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2507.1, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,5 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
The WP Fastest Cache Premium plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.7.4 via the 'get_server_time_ajax_request' AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,5 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to leak sensitive information from confidential issues by injecting hidden prompts into merge request comments.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Address to be embedded in them. The values cannot be changed later on, so the Apple profile generation page asks for those values and reflects…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki