Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device.
This vulnerability is due to insufficient validation of user-supplied input. An attacker…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wsp_get_posts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate() method accepts any…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IA_NA options.…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted_jar_paths'.
The startup flag 'trusted_jar_paths' references URIs for loading files from local or remote filesystems.…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeAtelier IDonatePro idonate-pro allows Retrieve Embedded Sensitive Data.This issue affects IDonatePro: from n/a through <= 2.1.9.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the search_name and search_email GET parameters into both the user-list query and the COUNT query used for pagination without…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag: scope values. extractscopes/1 parses scopes of the form .tag: and calls rabbitdatacoercion:toatom() to convert to a tag atom. The token signature is…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
CVSS
6,5
EPSS
0,34 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device.
This vulnerability is due to insufficient validation of user-supplied input. An attacker…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wsp_get_posts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate() method accepts any…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IA_NA options.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted_jar_paths'.
The startup flag 'trusted_jar_paths' references URIs for loading files from local or remote filesystems.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeAtelier IDonatePro idonate-pro allows Retrieve Embedded Sensitive Data.This issue affects IDonatePro: from n/a through <= 2.1.9.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the search_name and search_email GET parameters into both the user-list query and the COUNT query used for pagination without…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag: scope values. extractscopes/1 parses scopes of the form .tag: and calls rabbitdatacoercion:toatom() to convert to a tag atom. The token signature is…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
6,5
0,34 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.