KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Nieograniczone zużycie zasobów w bibliotece gmrtd może prowadzić do spowolnienia i wyczerpania pamięci.
Brak autoryzacji w Jock On Air Now umożliwia nieautoryzowany dostęp do zasobów.
The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and including, 2.0.3. This is due to the plugin exposing admin-level AJAX actions to unauthenticated users via wp_ajax_nopriv_ hooks, while relying…
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.…
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: LDAP). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.…
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK:…
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with…
Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7.
Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0.
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm_hashes field, ranges in the…
Wykorzystanie API Zabbix przez uwierzytelnionych użytkowników pozwala na wyciek klucza PSK, co zagraża integralności danych.
Potencjalna luka w HPE iLO 6 może prowadzić do odmowy usługi.
Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected by inconsistent repository filtering in bitbucket server catalog event updates. Deployments using event-driven updates in the…
Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is…
Luka w PeopleSoft Enterprise CS umożliwia nieautoryzowany dostęp do krytycznych danych.
Wstrzyknięcie skryptów w TheGem Theme Elements umożliwia atak XSS.
Wykorzystanie twardo zakodowanego klucza kryptograficznego w NeuVector naraża dane na ujawnienie.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle…
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of service against a Representational State Transfer (REST) API endpoint in the Discover Splunk Observability Cloud app. The…
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer (REST) API to an attacker-controlled host…
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to…
Brak kontroli uprawnień w wtyczce QSM dla WordPressa pozwala na nieautoryzowany dostęp do quizów.
Błąd obsługi błędów w Modem może prowadzić do zdalnego odmowy usługi.
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/html_backend.py, docling/backend/jats_backend.py, and…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Nieograniczone zużycie zasobów w bibliotece gmrtd może prowadzić do spowolnienia i wyczerpania pamięci. | Nieograniczone zużycie zasobów w bibliotece gmrtd może prowadzić do spowolnienia i wyczerpania pamięci. |
Do wiadomości | 6,5 | 0,27 % | ||
| Brak autoryzacji w Jock On Air Now umożliwia nieautoryzowany dostęp do zasobów. | Brak autoryzacji w Jock On Air Now umożliwia nieautoryzowany dostęp do zasobów. |
Do wiadomości | 6,5 | 0,27 % | ||
| The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all… | The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and including, 2.0.3. This is due to the plugin exposing admin-level AJAX actions to unauthenticated users via wp_ajax_nopriv_ hooks, while relying… |
Do wiadomości | 6,5 | 0,27 % | ||
| Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.… |
Do wiadomości | 6,5 | 0,27 % | ||
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: LDAP). | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: LDAP). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.… |
Do wiadomości | 6,5 | 0,27 % | ||
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:… | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK:… |
Do wiadomości | 6,5 | 0,27 % | ||
| Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). | Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with… |
Do wiadomości | 6,5 | 0,27 % | ||
| Missing Authorization vulnerability in Magepeople inc. | Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7. |
Do wiadomości | 6,5 | 0,27 % | ||
| Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured… | Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0. |
Do wiadomości | 6,5 | 0,27 % | ||
| A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its… | A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled. |
Do wiadomości | 6,5 | 0,27 % | ||
| vLLM is an inference and serving engine for large language models. | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm_hashes field, ranges in the… |
Do wiadomości | 6,5 | 0,27 % | ||
| Wykorzystanie API Zabbix przez uwierzytelnionych użytkowników pozwala na wyciek klucza PSK, co zagraża integralności danych. | Wykorzystanie API Zabbix przez uwierzytelnionych użytkowników pozwala na wyciek klucza PSK, co zagraża integralności danych. |
Do wiadomości | 6,5 | 0,27 % | ||
| Potencjalna luka w HPE iLO 6 może prowadzić do odmowy usługi. | Potencjalna luka w HPE iLO 6 może prowadzić do odmowy usługi. |
Do wiadomości | 6,5 | 0,27 % | ||
| Backstage is an open framework for building developer portals. | Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected by inconsistent repository filtering in bitbucket server catalog event updates. Deployments using event-driven updates in the… |
Do wiadomości | 6,5 | 0,27 % | ||
| Plane is an open-source project management tool. | Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is… |
Do wiadomości | 6,5 | 0,27 % | ||
| Luka w PeopleSoft Enterprise CS umożliwia nieautoryzowany dostęp do krytycznych danych. | Luka w PeopleSoft Enterprise CS umożliwia nieautoryzowany dostęp do krytycznych danych. |
Do wiadomości | 6,5 | 0,27 % | ||
| Wstrzyknięcie skryptów w TheGem Theme Elements umożliwia atak XSS. | Wstrzyknięcie skryptów w TheGem Theme Elements umożliwia atak XSS. |
Do wiadomości | 6,5 | 0,27 % | ||
| Wykorzystanie twardo zakodowanego klucza kryptograficznego w NeuVector naraża dane na ujawnienie. | Wykorzystanie twardo zakodowanego klucza kryptograficznego w NeuVector naraża dane na ujawnienie. |
Do wiadomości | 6,5 | 0,27 % | ||
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:… | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle… |
Do wiadomości | 6,5 | 0,27 % | ||
| In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk… | In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of service against a Representational State Transfer (REST) API endpoint in the Discover Splunk Observability Cloud app. The… |
Do wiadomości | 6,5 | 0,27 % | ||
| In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could… | In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer (REST) API to an attacker-controlled host… |
Do wiadomości | 6,5 | 0,27 % | ||
| The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX… | The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to… |
Do wiadomości | 6,5 | 0,27 % | ||
| Brak kontroli uprawnień w wtyczce QSM dla WordPressa pozwala na nieautoryzowany dostęp do quizów. | Brak kontroli uprawnień w wtyczce QSM dla WordPressa pozwala na nieautoryzowany dostęp do quizów. |
Do wiadomości | 6,5 | 0,27 % | ||
| Błąd obsługi błędów w Modem może prowadzić do zdalnego odmowy usługi. | Błąd obsługi błędów w Modem może prowadzić do zdalnego odmowy usługi. |
Do wiadomości | 6,5 | 0,27 % | ||
| Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/html_backend.py, docling/backend/jats_backend.py, and… |
Do wiadomości | 6,5 | 0,27 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.