KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Błąd w IBM Db2 Intelligence Center umożliwia uwierzytelnionemu użytkownikowi nieautoryzowane działania.
The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server.…
Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions…
Improper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured…
Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.
Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested credential-bearing values.…
Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knit Pay: from n/a through 9.6.3.0.
Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.2.
Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions.
Brak autoryzacji w The Plus Addons for Elementor Pro umożliwia nieautoryzowany dostęp.
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very…
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and…
Błąd w open-iscsi pozwala zdalnemu atakującemu na DoS iscsiuio przez złośliwe ICMPv6.
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks…
Unauthenticated Content Injection in Boutique <= 2.3.3 versions.
Błąd w AVideo pozwala na fałszowanie webhooków, co umożliwia nieautoryzowane kredytowanie portfeli użytkowników.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for Elementor - Lite: from n/a through 2.9.5.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for Elementor – Media Player widget for WP media-player-addons-for-elementor allows Stored XSS.This issue affects Media Player Addons for Elementor – Media Player…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Rootblox rootblox allows Stored XSS.This issue affects Rootblox: from n/a through 1.0.7.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored XSS.This issue affects Brizy: 2.8.23.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Błąd w IBM Db2 Intelligence Center umożliwia uwierzytelnionemu użytkownikowi nieautoryzowane działania. | Błąd w IBM Db2 Intelligence Center umożliwia uwierzytelnionemu użytkownikowi nieautoryzowane działania. |
Do wiadomości | 6,5 | 0,21 % | ||
| The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. | The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests. |
Do wiadomości | 6,5 | 0,21 % | ||
| ImageMagick is free and open-source software used for editing and manipulating digital images. | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server.… |
Do wiadomości | 6,5 | 0,21 % | ||
| Backstage is an open framework for building developer portals. | Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions… |
Do wiadomości | 6,5 | 0,21 % | ||
| Improper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to… | Improper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) |
Do wiadomości | 6,5 | 0,21 % | ||
| A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. | A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured… |
Do wiadomości | 6,5 | 0,21 % | ||
| Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions. | Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions. |
Do wiadomości | 6,5 | 0,21 % | ||
| Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions. | Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions. |
Do wiadomości | 6,5 | 0,21 % | ||
| MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested credential-bearing values.… |
Do wiadomości | 6,5 | 0,21 % | ||
| Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access Control Security… | Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knit Pay: from n/a through 9.6.3.0. |
Do wiadomości | 6,5 | 0,21 % | ||
| Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly… | Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.2. |
Do wiadomości | 6,5 | 0,21 % | ||
| Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions. | Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions. |
Do wiadomości | 6,5 | 0,21 % | ||
| Brak autoryzacji w The Plus Addons for Elementor Pro umożliwia nieautoryzowany dostęp. | Brak autoryzacji w The Plus Addons for Elementor Pro umożliwia nieautoryzowany dostęp. |
Do wiadomości | 6,5 | 0,21 % | ||
| A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. | A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very… |
Do wiadomości | 6,5 | 0,21 % | ||
| Plane is an open-source project management tool. | Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and… |
Do wiadomości | 6,5 | 0,21 % | ||
| Błąd w open-iscsi pozwala zdalnemu atakującemu na DoS iscsiuio przez złośliwe ICMPv6. | Błąd w open-iscsi pozwala zdalnemu atakującemu na DoS iscsiuio przez złośliwe ICMPv6. |
Do wiadomości | 6,5 | 0,21 % | ||
| Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks… |
Do wiadomości | 6,5 | 0,21 % | ||
| Unauthenticated Content Injection in Boutique <= 2.3.3 versions. | Unauthenticated Content Injection in Boutique <= 2.3.3 versions. |
Do wiadomości | 6,5 | 0,21 % | ||
| Błąd w AVideo pozwala na fałszowanie webhooków, co umożliwia nieautoryzowane kredytowanie portfeli użytkowników. | Błąd w AVideo pozwala na fałszowanie webhooków, co umożliwia nieautoryzowane kredytowanie portfeli użytkowników. |
Do wiadomości | 6,5 | 0,21 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for Elementor - Lite: from n/a through 2.9.5. |
Do wiadomości | 6,5 | 0,2 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for Elementor – Media Player widget for WP media-player-addons-for-elementor allows Stored XSS.This issue affects Media Player Addons for Elementor – Media Player… |
Do wiadomości | 6,5 | 0,2 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.2. |
Do wiadomości | 6,5 | 0,2 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5. |
Do wiadomości | 6,5 | 0,2 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Rootblox rootblox allows… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Rootblox rootblox allows Stored XSS.This issue affects Rootblox: from n/a through 1.0.7. |
Do wiadomości | 6,5 | 0,2 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored XSS.This issue affects Brizy: 2.8.23. |
Do wiadomości | 6,5 | 0,2 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.