KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
PostgreSQL SQL Injection (status_sql.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform SQL injection via sw1 and sw2 parameters in status_sql.php. The `status_sql.php` endpoint…
The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the…
When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of…
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.
Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by supplying arbitrary content IDs. Attackers can enumerate sequential post_content ids via the /v1/attachment endpoint…
DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source,…
Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the project_id from the URL. ProjectPagePermission likewise derives the caller's role from the…
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the…
Błędna autoryzacja w StorageAccessAPI w Google Chrome umożliwia obejście polityki pochodzenia.
Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Nieprawidłowe unieważnianie tokenów OAuth w Mattermost umożliwia dostęp deaktywowanym użytkownikom.
Brak weryfikacji wygasania i integralności w awslabs/tough pozwala na złośliwe modyfikacje metadanych.
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). Supported versions that are affected are 8.2.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise…
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an…
Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130).
Błąd w IBM Sterling B2B Integrator i File Gateway pozwala uwierzytelnionemu użytkownikowi na dostęp do wrażliwych danych.
Błąd logiczny w modemie komórkowym może prowadzić do zdalnego odmowy usługi bez interakcji użytkownika.
Błędne sprawdzenie granic w SwDcpItg może prowadzić do zdalnego odmowy usługi.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to cause a denial of service condition by uploading specially crafted images.
Dell PowerProtect One, versions 20.1.0.0 and below, contain a Reliance on Insufficiently Trustworthy Component vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Cache poisoning.
Incorrect authorization in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Błąd użycia po zwolnieniu pamięci w warstwie ATT Bluetooth prowadzi do awarii hosta Bluetooth.
Luka w Oracle Contracts Integration pozwala na nieautoryzowaną modyfikację danych.
Podatność w Java VM w Oracle Database Server umożliwia nieautoryzowaną modyfikację danych.
Luka w Oracle Enterprise Manager umożliwia nieautoryzowaną modyfikację danych.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| PostgreSQL SQL Injection (status_sql.php) in DB Electronica Telecomunicazioni S.p.A. | PostgreSQL SQL Injection (status_sql.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform SQL injection via sw1 and sw2 parameters in status_sql.php. The `status_sql.php` endpoint… |
Do wiadomości | 6,5 | 0,31 % | ||
| The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. | The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the… |
Do wiadomości | 6,5 | 0,31 % | ||
| When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per… | When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of… |
Do wiadomości | 6,5 | 0,31 % | ||
| The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its… | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks. |
Do wiadomości | 6,5 | 0,31 % | ||
| Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows… | Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by supplying arbitrary content IDs. Attackers can enumerate sequential post_content ids via the /v1/attachment endpoint… |
Do wiadomości | 6,5 | 0,3 % | ||
| DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows… | DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source,… |
Do wiadomości | 6,5 | 0,3 % | ||
| Plane is an open-source project management tool. | Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the project_id from the URL. ProjectPagePermission likewise derives the caller's role from the… |
Do wiadomości | 6,5 | 0,3 % | ||
| Plane is an open-source project management tool. | Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the… |
Do wiadomości | 6,5 | 0,3 % | ||
| Błędna autoryzacja w StorageAccessAPI w Google Chrome umożliwia obejście polityki pochodzenia. | Błędna autoryzacja w StorageAccessAPI w Google Chrome umożliwia obejście polityki pochodzenia. |
Do wiadomości | 6,5 | 0,3 % | ||
| Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the… | Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Do wiadomości | 6,5 | 0,3 % | ||
| Nieprawidłowe unieważnianie tokenów OAuth w Mattermost umożliwia dostęp deaktywowanym użytkownikom. | Nieprawidłowe unieważnianie tokenów OAuth w Mattermost umożliwia dostęp deaktywowanym użytkownikom. |
Do wiadomości | 6,5 | 0,3 % | ||
| Brak weryfikacji wygasania i integralności w awslabs/tough pozwala na złośliwe modyfikacje metadanych. | Brak weryfikacji wygasania i integralności w awslabs/tough pozwala na złośliwe modyfikacje metadanych. |
Do wiadomości | 6,5 | 0,3 % | ||
| Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). Supported versions that are affected are 8.2.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise… |
Do wiadomości | 6,5 | 0,3 % | ||
| Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an… |
Do wiadomości | 6,5 | 0,3 % | ||
| Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node,… | Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130). |
Do wiadomości | 6,5 | 0,3 % | ||
| Błąd w IBM Sterling B2B Integrator i File Gateway pozwala uwierzytelnionemu użytkownikowi na dostęp do wrażliwych danych. | Błąd w IBM Sterling B2B Integrator i File Gateway pozwala uwierzytelnionemu użytkownikowi na dostęp do wrażliwych danych. |
Do wiadomości | 6,5 | 0,3 % | ||
| Błąd logiczny w modemie komórkowym może prowadzić do zdalnego odmowy usługi bez interakcji użytkownika. | Błąd logiczny w modemie komórkowym może prowadzić do zdalnego odmowy usługi bez interakcji użytkownika. |
Do wiadomości | 6,5 | 0,3 % | ||
| Błędne sprawdzenie granic w SwDcpItg może prowadzić do zdalnego odmowy usługi. | Błędne sprawdzenie granic w SwDcpItg może prowadzić do zdalnego odmowy usługi. |
Do wiadomości | 6,5 | 0,3 % | ||
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2… | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to cause a denial of service condition by uploading specially crafted images. |
Do wiadomości | 6,5 | 0,3 % | ||
| Dell PowerProtect One, versions 20.1.0.0 and below, contain a Reliance on Insufficiently Trustworthy Component vulnerability. | Dell PowerProtect One, versions 20.1.0.0 and below, contain a Reliance on Insufficiently Trustworthy Component vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Cache poisoning. |
Do wiadomości | 6,5 | 0,3 % | ||
| Incorrect authorization in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain… | Incorrect authorization in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
Do wiadomości | 6,5 | 0,3 % | ||
| Błąd użycia po zwolnieniu pamięci w warstwie ATT Bluetooth prowadzi do awarii hosta Bluetooth. | Błąd użycia po zwolnieniu pamięci w warstwie ATT Bluetooth prowadzi do awarii hosta Bluetooth. |
Do wiadomości | 6,5 | 0,3 % | ||
| Luka w Oracle Contracts Integration pozwala na nieautoryzowaną modyfikację danych. | Luka w Oracle Contracts Integration pozwala na nieautoryzowaną modyfikację danych. |
Do wiadomości | 6,5 | 0,3 % | ||
| Podatność w Java VM w Oracle Database Server umożliwia nieautoryzowaną modyfikację danych. | Podatność w Java VM w Oracle Database Server umożliwia nieautoryzowaną modyfikację danych. |
Do wiadomości | 6,5 | 0,3 % | ||
| Luka w Oracle Enterprise Manager umożliwia nieautoryzowaną modyfikację danych. | Luka w Oracle Enterprise Manager umożliwia nieautoryzowaną modyfikację danych. |
Do wiadomości | 6,5 | 0,3 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.