Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attackers…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. This is due to a time-of-check/time-of-use (TOCTOU) race condition in the 'url' parameter of the fpd_custom_uplod_file AJAX action. The plugin validates the URL…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Implemented CSRF protection mechanism can be bypassed by using CSRF token of other user. It is worth noting that the registration is open and anyone can create an account.
Only version 4.1 was tested and…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
PraisonAI is a multi-agent teams system. In `praisonai-platform` prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges,…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State Transfer (REST) API and cause Splunk SOAR to apply the license change.
The vulnerability is possible because Splunk SOAR authenticates requests to manage the…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata.
Server metadata is often used to store site wide configuration data that should only be updated by the server…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attackers…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. This is due to a time-of-check/time-of-use (TOCTOU) race condition in the 'url' parameter of the fpd_custom_uplod_file AJAX action. The plugin validates the URL…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Implemented CSRF protection mechanism can be bypassed by using CSRF token of other user. It is worth noting that the registration is open and anyone can create an account.
Only version 4.1 was tested and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
PraisonAI is a multi-agent teams system. In `praisonai-platform` prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State Transfer (REST) API and cause Splunk SOAR to apply the license change.
The vulnerability is possible because Splunk SOAR authenticates requests to manage the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata.
Server metadata is often used to store site wide configuration data that should only be updated by the server…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki