KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Błąd w obsłudze IPv6 Neighbor Discovery pozwala na ataki typu man-in-the-middle i przejęcie ruchu.
Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions.
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates archive entry names but extracts them directly into the authorized live destination before validating resolved paths. If that destination already contains a…
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with force_download='allow-local' or web_fetch_tool with…
The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page is…
The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blocks before rendering it, allowing users with contributor-level access and above to store malicious scripts that execute when another user views and interacts with the…
The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the browser, allowing authenticated users with Contributor-level access and above to store malicious SVG that executes JavaScript in…
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes…
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting…
Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff…
Przechodzenie po względnych ścieżkach w Microsoft Edge na Androidzie umożliwia ujawnienie informacji lokalnych.
Nieprawidłowe sanitizowanie odpowiedzi błędów w Mattermost umożliwia ujawnienie klucza API OpenAI.
Obejście blokady metadanych w Pydantic AI umożliwia ujawnienie krótkoterminowych poświadczeń IAM.
Luka w Discourse umożliwia administratorowi dostęp do backupów z innej witryny w multisite.
Przepełnienie bufora w Keycloak umożliwia eskalację uprawnień przez użytkownika z niskimi uprawnieniami.
Podatność w SWUpdate umożliwia atakującym zdalne wywołanie odmowy usługi przez złośliwy POST.
Modyfikacja danych w LangGraph SQLite Checkpoint umożliwia niebezpieczną rekonstrukcję obiektów.
Włączenie interfejsu USB w Entrust nShield umożliwia eskalację uprawnień przez atak fizyczny.
Modyfikacja firmware'u w Entrust nShield umożliwia atakującemu wpływ na proces uruchamiania.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft…
The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9's translator capability to retrieve the contents of files of certain types from anywhere on the server,…
Brak walidacji referencji plików w Pydantic AI pozwala na nieautoryzowany dostęp do danych.
Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Planning.…
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.…
Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite (component: Regression Testing). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Błąd w obsłudze IPv6 Neighbor Discovery pozwala na ataki typu man-in-the-middle i przejęcie ruchu. | Błąd w obsłudze IPv6 Neighbor Discovery pozwala na ataki typu man-in-the-middle i przejęcie ruchu. |
Do wiadomości | 6,8 | 0,33 % | ||
| Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions. | Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions. |
Do wiadomości | 6,8 | 0,33 % | ||
| FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates archive entry names but extracts them directly into the authorized live destination before validating resolved paths. If that destination already contains a… |
Do wiadomości | 6,8 | 0,32 % | ||
| Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with force_download='allow-local' or web_fetch_tool with… |
Do wiadomości | 6,8 | 0,32 % | ||
| The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in… | The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page is… |
Do wiadomości | 6,8 | 0,32 % | ||
| The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blocks before… | The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blocks before rendering it, allowing users with contributor-level access and above to store malicious scripts that execute when another user views and interacts with the… |
Do wiadomości | 6,8 | 0,32 % | ||
| The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and… | The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the browser, allowing authenticated users with Contributor-level access and above to store malicious SVG that executes JavaScript in… |
Do wiadomości | 6,8 | 0,32 % | ||
| The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before… | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes… |
Do wiadomości | 6,8 | 0,32 % | ||
| The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before… | The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting… |
Do wiadomości | 6,8 | 0,32 % | ||
| Ghost is a Node.js content management system. | Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff… |
Do wiadomości | 6,8 | 0,32 % | ||
| Przechodzenie po względnych ścieżkach w Microsoft Edge na Androidzie umożliwia ujawnienie informacji lokalnych. | Przechodzenie po względnych ścieżkach w Microsoft Edge na Androidzie umożliwia ujawnienie informacji lokalnych. |
Do wiadomości | 6,8 | 0,32 % | ||
| Nieprawidłowe sanitizowanie odpowiedzi błędów w Mattermost umożliwia ujawnienie klucza API OpenAI. | Nieprawidłowe sanitizowanie odpowiedzi błędów w Mattermost umożliwia ujawnienie klucza API OpenAI. |
Do wiadomości | 6,8 | 0,32 % | ||
| Obejście blokady metadanych w Pydantic AI umożliwia ujawnienie krótkoterminowych poświadczeń IAM. | Obejście blokady metadanych w Pydantic AI umożliwia ujawnienie krótkoterminowych poświadczeń IAM. |
Do wiadomości | 6,8 | 0,32 % | ||
| Luka w Discourse umożliwia administratorowi dostęp do backupów z innej witryny w multisite. | Luka w Discourse umożliwia administratorowi dostęp do backupów z innej witryny w multisite. |
Do wiadomości | 6,8 | 0,32 % | ||
| Przepełnienie bufora w Keycloak umożliwia eskalację uprawnień przez użytkownika z niskimi uprawnieniami. | Przepełnienie bufora w Keycloak umożliwia eskalację uprawnień przez użytkownika z niskimi uprawnieniami. |
Do wiadomości | 6,8 | 0,32 % | ||
| Podatność w SWUpdate umożliwia atakującym zdalne wywołanie odmowy usługi przez złośliwy POST. | Podatność w SWUpdate umożliwia atakującym zdalne wywołanie odmowy usługi przez złośliwy POST. |
Do wiadomości | 6,8 | 0,32 % | ||
| Modyfikacja danych w LangGraph SQLite Checkpoint umożliwia niebezpieczną rekonstrukcję obiektów. | Modyfikacja danych w LangGraph SQLite Checkpoint umożliwia niebezpieczną rekonstrukcję obiektów. |
Do wiadomości | 6,8 | 0,32 % | ||
| Włączenie interfejsu USB w Entrust nShield umożliwia eskalację uprawnień przez atak fizyczny. | Włączenie interfejsu USB w Entrust nShield umożliwia eskalację uprawnień przez atak fizyczny. |
Do wiadomości | 6,8 | 0,32 % | ||
| Modyfikacja firmware'u w Entrust nShield umożliwia atakującemu wpływ na proces uruchamiania. | Modyfikacja firmware'u w Entrust nShield umożliwia atakującemu wpływ na proces uruchamiania. |
Do wiadomości | 6,8 | 0,32 % | ||
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft… |
Do wiadomości | 6,8 | 0,32 % | ||
| The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users… | The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9's translator capability to retrieve the contents of files of certain types from anywhere on the server,… |
Do wiadomości | 6,8 | 0,32 % | ||
| Brak walidacji referencji plików w Pydantic AI pozwala na nieautoryzowany dostęp do danych. | Brak walidacji referencji plików w Pydantic AI pozwala na nieautoryzowany dostęp do danych. |
Do wiadomości | 6,8 | 0,32 % | ||
| Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). | Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Planning.… |
Do wiadomości | 6,8 | 0,31 % | ||
| Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). | Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.… |
Do wiadomości | 6,8 | 0,31 % | ||
| Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite (component: Regression Testing). | Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite (component: Regression Testing). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise… |
Do wiadomości | 6,8 | 0,31 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.