KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Deserializacja danych z referencji LDAP w Jenkins LDAP Plugin umożliwia atakującemu wykonanie kodu.
Brak kontroli dostępu w routerze U-SPEED AC1200 umożliwia nieautoryzowany dostęp do funkcji urządzenia.
Błąd w Spring Security umożliwia podszycie się pod innego użytkownika przez złośliwy certyfikat.
A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Successful exploitation of this vulnerability could allow an attacker with administrative access to execute specific code that renders the switch non-bootable and effectively non-functional.
The Jeg Kit for Elementor WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via xmlrpc.php, leading to a cross site scripting vulnerability.
Słaby algorytm generowania haseł w systemie umożliwia atakującemu zdalne przejęcie konta administratora.
Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system. Successful exploitation could enable the attacker to execute arbitrary operating system…
The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials,…
Wykonanie zdalnego kodu w Renovate umożliwia wykorzystanie złośliwych zależności w bazel-module.
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle…
Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise WebCenter Content: Imaging.…
Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via SOAP to compromise WebCenter Content: Imaging.…
Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle…
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). The supported version that is affected is 26.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful…
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult…
The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the…
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the…
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected…
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing a gallery,…
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery…
The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.
The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing…
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject…
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the…
Twardo zakodowane dane uwierzytelniające w kamerze IP ANJIA umożliwiają nieautoryzowany dostęp do bootloadera.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Deserializacja danych z referencji LDAP w Jenkins LDAP Plugin umożliwia atakującemu wykonanie kodu. | Deserializacja danych z referencji LDAP w Jenkins LDAP Plugin umożliwia atakującemu wykonanie kodu. |
Do wiadomości | 6,6 | 1,3 % | ||
| Brak kontroli dostępu w routerze U-SPEED AC1200 umożliwia nieautoryzowany dostęp do funkcji urządzenia. | Brak kontroli dostępu w routerze U-SPEED AC1200 umożliwia nieautoryzowany dostęp do funkcji urządzenia. |
Do wiadomości | 6,8 | 0,3 % | ||
| Błąd w Spring Security umożliwia podszycie się pod innego użytkownika przez złośliwy certyfikat. | Błąd w Spring Security umożliwia podszycie się pod innego użytkownika przez złośliwy certyfikat. |
Do wiadomości | 6,8 | 0,3 % | ||
| A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. | A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Successful exploitation of this vulnerability could allow an attacker with administrative access to execute specific code that renders the switch non-bootable and effectively non-functional. |
Do wiadomości | 6,8 | 0,3 % | ||
| The Jeg Kit for Elementor WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via xmlrpc.php, leading to a… | The Jeg Kit for Elementor WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via xmlrpc.php, leading to a cross site scripting vulnerability. |
Do wiadomości | 6,8 | 0,3 % | ||
| Słaby algorytm generowania haseł w systemie umożliwia atakującemu zdalne przejęcie konta administratora. | Słaby algorytm generowania haseł w systemie umożliwia atakującemu zdalne przejęcie konta administratora. |
Do wiadomości | 6,8 | 0,3 % | ||
| Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could… | Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system. Successful exploitation could enable the attacker to execute arbitrary operating system… |
Do wiadomości | 6,8 | 0,3 % | ||
| The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML… | The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials,… |
Do wiadomości | 6,8 | 0,3 % | ||
| Wykonanie zdalnego kodu w Renovate umożliwia wykorzystanie złośliwych zależności w bazel-module. | Wykonanie zdalnego kodu w Renovate umożliwia wykorzystanie złośliwych zależności w bazel-module. |
Do wiadomości | 6,8 | 0,29 % | ||
| Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle… |
Do wiadomości | 6,8 | 0,29 % | ||
| Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). | Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise WebCenter Content: Imaging.… |
Do wiadomości | 6,8 | 0,29 % | ||
| Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). | Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via SOAP to compromise WebCenter Content: Imaging.… |
Do wiadomości | 6,8 | 0,29 % | ||
| Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: LOV). | Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle… |
Do wiadomości | 6,8 | 0,29 % | ||
| Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). The supported version that is affected is 26.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful… |
Do wiadomości | 6,8 | 0,29 % | ||
| Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Privileges). | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult… |
Do wiadomości | 6,8 | 0,29 % | ||
| The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the… | The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the… |
Do wiadomości | 6,8 | 0,29 % | ||
| The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a… | The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the… |
Do wiadomości | 6,8 | 0,29 % | ||
| The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery… | The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected… |
Do wiadomości | 6,8 | 0,29 % | ||
| The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page,… | The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing a gallery,… |
Do wiadomości | 6,8 | 0,29 % | ||
| The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the… | The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery… |
Do wiadomości | 6,8 | 0,29 % | ||
| The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting… | The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed. |
Do wiadomości | 6,8 | 0,29 % | ||
| The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into… | The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing… |
Do wiadomości | 6,8 | 0,29 % | ||
| The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be… | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject… |
Do wiadomości | 6,8 | 0,29 % | ||
| The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in… | The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the… |
Do wiadomości | 6,8 | 0,29 % | ||
| Twardo zakodowane dane uwierzytelniające w kamerze IP ANJIA umożliwiają nieautoryzowany dostęp do bootloadera. | Twardo zakodowane dane uwierzytelniające w kamerze IP ANJIA umożliwiają nieautoryzowany dostęp do bootloadera. |
Do wiadomości | 6,8 | 0,29 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.