Dotkliwość: Średnia

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a…

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product.

An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature.

Eskalacja uprawnień w Palo Alto Cortex XDR umożliwia zdalne wykonanie kodu z uprawnieniami roota.

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo…

Refleksyjny atak XSS w Form Maker 10Web pozwala na wstrzyknięcie skryptów przez nieautoryzowanych użytkowników.

A vulnerability in the EndPoint Data Loss Prevention (DLP) enforcement of Palo Alto Networks Prisma® Access Agent enables a local user to bypass configured DLP policy enforcement controls and exfiltrate sensitive data. This Prisma Access Agent on macOS, Linux, iOS, Android and Chrome OS is…

Wielokrotne luki w podnoszeniu uprawnień w aplikacji GlobalProtect umożliwiają lokalnemu użytkownikowi eskalację uprawnień do SYSTEM na Windows oraz…

Wstrzyknięcie poleceń w PAN-OS umożliwia administratorowi wykonanie dowolnych komend jako root.

An information disclosure vulnerability in the Palo Alto Networks Prisma® Access Agent on Linux enables a local user to access sensitive configuration data and credentials. The Prisma Access Agent on macOS, Windows, iOS, Android and Chrome OS is not affected.

Deserializacja parametrów w Apache Artemis może prowadzić do odmowy usługi przez nadmierne obciążenie.

Wykorzystanie złośliwych wildcardów w Apache Artemis prowadzi do odmowy usługi.

The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the control_selectors meta field in all versions up to, and including, 2.0.4. This is due to the plugin registering the control_selectors meta field with show_in_rest enabled but without a…

The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Photo Module 'attributes' Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

Brak weryfikacji uprawnień w wtyczce Builderall Cheetah umożliwia atakującym modyfikację danych.

Wtyczka WP BackItUp umożliwia atakującym odczyt wrażliwych plików na serwerze.

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with…

The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bg_video_service_url' Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

Obejście autoryzacji w BurgerEditor umożliwia atakującemu modyfikację treści strony.

Wtyczka Ninja Forms - Scheduled Exports w WordPress jest podatna na przechowywane XSS przez REST API.

Błąd użycia po zwolnieniu pamięci w cJSON umożliwia zdalne wykonanie ataku.

A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument pro_name[] results in sql injection. The…

A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This affects an unknown part of the file includes/invoice_bill.php of the component Invoice Generation. Such manipulation of the argument order_date/invoice_no leads…

The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/classic/l2cap_br.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BT_L2CAP_CONNECTED state. A dynamic channel is…

Błąd w Open WebUI pozwala na zablokowanie pętli asynchronicznej przez cykl wiadomości.