Baza CVE

Wstrzyknięcie skryptów w Drupal Entity Browser umożliwia atak XSS.

Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rentsyst: from n/a through…

Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated…

Błąd w Kimai umożliwia użytkownikom z uprawnieniami edycji usunięcie dostępu zespołu bez weryfikacji.

Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web…

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team…

Kimai (kimai/kimai) before 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project…

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with…

Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with createEntries permission to…

Błąd w Craft CMS pozwala atakującym na odczyt danych użytkowników, w tym administratorów.

Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.

Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.

Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.

Atak Denial of Service w WP Go Maps powoduje niedostępność usługi.

Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.

Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections…

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject…

Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.

Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.

Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.

Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified…

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1.

Brak odpowiedniego uciekania XSS w Spark History Server umożliwia eskalację uprawnień w przeglądarce.

In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or…

Brak walidacji parametrów w reset_password.html pozwala na przekierowanie użytkowników na złośliwe strony.