KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3.
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an…
Missing Authorization vulnerability in iatoai IATO MCP iato-mcp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IATO MCP: from n/a through 1.12.0.
Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server…
A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a…
Brak tokena CSRF w OpenBK7231T pozwala na usunięcie hasła administratora przez GET.
Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Difficult…
Wykonanie dowolnych poleceń w Dokploy umożliwia atakującemu z uprawnieniami administratora.
The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) protection mechanisms (no tokens, no Origin/Referer validation) on critical configuration endpoints.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through 1.5.2.1.
libming through 0.4.8 contains a heap buffer overflow in r_readc() in src/blocks/fromswf.c. A crafted SWF file with a malformed or truncated RECT header can cause a denial of service.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Stored XSS.This issue affects RepairBuddy: from n/a through 4.1225.
Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0.
Błąd w wtyczce WPCafe dla WordPressa umożliwia nieautoryzowanym użytkownikom dostęp do informacji o zamówieniach.
Nieprawidłowe kontrole dostępu w Tanium Comply mogą prowadzić do nieautoryzowanego dostępu.
Obejście uwierzytelnienia w WooCommerce umożliwia nieautoryzowany dostęp do zamówień.
Brak weryfikacji ID w wtyczce WC Vendors pozwala sprzedawcom na modyfikację produktów innych użytkowników.
Eskalacja uprawnień w HPE Networking Fabric Composer pozwala na zmianę ustawień przez niskoprzywilejowego użytkownika.
Wstrzyknięcie skryptów w TheFox umożliwia atak XSS.
Nieodpowiednia implementacja w rozszerzeniach Google Chrome na Androidzie umożliwia obejście polityki samego pochodzenia.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control… | Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3. |
Do wiadomości | 6,5 | 0,17 % | ||
| The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the… | The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an… |
Do wiadomości | 6,5 | 0,17 % | ||
| Missing Authorization vulnerability in iatoai IATO MCP iato-mcp allows Exploiting Incorrectly Configured Access Control Security… | Missing Authorization vulnerability in iatoai IATO MCP iato-mcp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IATO MCP: from n/a through 1.12.0. |
Do wiadomości | 6,5 | 0,17 % | ||
| Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. | Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server… |
Do wiadomości | 6,5 | 0,17 % | ||
| A privilege mismatch was found in Fleet. | A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a… |
Do wiadomości | 6,5 | 0,17 % | ||
| Brak tokena CSRF w OpenBK7231T pozwala na usunięcie hasła administratora przez GET. | Brak tokena CSRF w OpenBK7231T pozwala na usunięcie hasła administratora przez GET. |
Do wiadomości | 6,5 | 0,17 % | ||
| Clickjacking issue in the WebExtensions component in Firefox for Android. | Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153. |
Do wiadomości | 6,5 | 0,17 % | ||
| Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web… | Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Difficult… |
Do wiadomości | 6,5 | 0,17 % | ||
| Wykonanie dowolnych poleceń w Dokploy umożliwia atakującemu z uprawnieniami administratora. | Wykonanie dowolnych poleceń w Dokploy umożliwia atakującemu z uprawnieniami administratora. |
Do wiadomości | 6,4 | 0,67 % | ||
| The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site… | The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) protection mechanisms (no tokens, no Origin/Referer validation) on critical configuration endpoints. |
Do wiadomości | 6,5 | 0,17 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110. |
Do wiadomości | 6,5 | 0,17 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7. |
Do wiadomości | 6,5 | 0,17 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through 1.5.2.1. |
Do wiadomości | 6,5 | 0,17 % | ||
| libming through 0.4.8 contains a heap buffer overflow in r_readc() in src/blocks/fromswf.c. | libming through 0.4.8 contains a heap buffer overflow in r_readc() in src/blocks/fromswf.c. A crafted SWF file with a malformed or truncated RECT header can cause a denial of service. |
Do wiadomości | 6,5 | 0,17 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2. |
Do wiadomości | 6,5 | 0,17 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webful Creations RepairBuddy… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Stored XSS.This issue affects RepairBuddy: from n/a through 4.1225. |
Do wiadomości | 6,5 | 0,17 % | ||
| Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions. | Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions. |
Do wiadomości | 6,5 | 0,17 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Castos Seriously Simple Podcasting… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0. |
Do wiadomości | 6,5 | 0,17 % | ||
| Błąd w wtyczce WPCafe dla WordPressa umożliwia nieautoryzowanym użytkownikom dostęp do informacji o zamówieniach. | Błąd w wtyczce WPCafe dla WordPressa umożliwia nieautoryzowanym użytkownikom dostęp do informacji o zamówieniach. |
Do wiadomości | 6,5 | 0,17 % | ||
| Nieprawidłowe kontrole dostępu w Tanium Comply mogą prowadzić do nieautoryzowanego dostępu. | Nieprawidłowe kontrole dostępu w Tanium Comply mogą prowadzić do nieautoryzowanego dostępu. |
Do wiadomości | 6,5 | 0,17 % | ||
| Obejście uwierzytelnienia w WooCommerce umożliwia nieautoryzowany dostęp do zamówień. | Obejście uwierzytelnienia w WooCommerce umożliwia nieautoryzowany dostęp do zamówień. |
Do wiadomości | 6,5 | 0,17 % | ||
| Brak weryfikacji ID w wtyczce WC Vendors pozwala sprzedawcom na modyfikację produktów innych użytkowników. | Brak weryfikacji ID w wtyczce WC Vendors pozwala sprzedawcom na modyfikację produktów innych użytkowników. |
Do wiadomości | 6,5 | 0,17 % | ||
| Eskalacja uprawnień w HPE Networking Fabric Composer pozwala na zmianę ustawień przez niskoprzywilejowego użytkownika. | Eskalacja uprawnień w HPE Networking Fabric Composer pozwala na zmianę ustawień przez niskoprzywilejowego użytkownika. |
Do wiadomości | 6,5 | 0,17 % | ||
| Wstrzyknięcie skryptów w TheFox umożliwia atak XSS. | Wstrzyknięcie skryptów w TheFox umożliwia atak XSS. |
Do wiadomości | 6,5 | 0,17 % | ||
| Nieodpowiednia implementacja w rozszerzeniach Google Chrome na Androidzie umożliwia obejście polityki samego pochodzenia. | Nieodpowiednia implementacja w rozszerzeniach Google Chrome na Androidzie umożliwia obejście polityki samego pochodzenia. |
Do wiadomości | 6,5 | 0,17 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.