KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Brak autoryzacji w Bux Woocommerce umożliwia dostęp do funkcji bez odpowiednich ograniczeń.
Brak autoryzacji w Wikipedia Preview umożliwia nieautoryzowany dostęp do danych.
Brak autoryzacji w Breeze Checkout umożliwia nieautoryzowany dostęp do danych.
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor.
Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise…
Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A ':matches' pattern was matched by a backtracking descent whose time grew with the…
A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity…
Błąd walidacji wejścia w IBM RSCT 3.0 umożliwia zdalnemu atakującemu wywołanie odmowy usługi.
Nieprawidłowa walidacja danych w RDK-B WebUI pozwala uwierzytelnionemu atakującemu na wywołanie odmowy usługi.
Dereferencja wskaźnika null w IBM AIX i PowerVM VIOS może prowadzić do odmowy usługi.
Luka w systemie aktywacji licencji pozwala zdalnym atakującym na ominięcie autoryzacji płatności.
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64…
Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
Incorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Incorrect authorization in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and…
An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a shared FortiGate device via crafted HTTP requests.
Przepełnienie bufora w IBM DB2 High Performance Unload może prowadzić do awarii programu.
IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due to the incorrect calculation of the size of the data that is being pointed to.
Błąd zapisu poza granicami w IBM DB2 High Performance Unload może prowadzić do awarii programu.
IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could…
When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of…
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.
JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Brak autoryzacji w Bux Woocommerce umożliwia dostęp do funkcji bez odpowiednich ograniczeń. | Brak autoryzacji w Bux Woocommerce umożliwia dostęp do funkcji bez odpowiednich ograniczeń. |
Do wiadomości | 6,5 | 0,31 % | ||
| Brak autoryzacji w Wikipedia Preview umożliwia nieautoryzowany dostęp do danych. | Brak autoryzacji w Wikipedia Preview umożliwia nieautoryzowany dostęp do danych. |
Do wiadomości | 6,5 | 0,31 % | ||
| Brak autoryzacji w Breeze Checkout umożliwia nieautoryzowany dostęp do danych. | Brak autoryzacji w Breeze Checkout umożliwia nieautoryzowany dostęp do danych. |
Do wiadomości | 6,5 | 0,31 % | ||
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure… | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor. |
Do wiadomości | 6,5 | 0,31 % | ||
| Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. | Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise… |
Do wiadomości | 6,5 | 0,31 % | ||
| Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated… | Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A ':matches' pattern was matched by a backtracking descent whose time grew with the… |
Do wiadomości | 6,5 | 0,31 % | ||
| A flaw was found in Maestro. | A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity… |
Do wiadomości | 6,5 | 0,31 % | ||
| Błąd walidacji wejścia w IBM RSCT 3.0 umożliwia zdalnemu atakującemu wywołanie odmowy usługi. | Błąd walidacji wejścia w IBM RSCT 3.0 umożliwia zdalnemu atakującemu wywołanie odmowy usługi. |
Do wiadomości | 6,5 | 0,31 % | ||
| Nieprawidłowa walidacja danych w RDK-B WebUI pozwala uwierzytelnionemu atakującemu na wywołanie odmowy usługi. | Nieprawidłowa walidacja danych w RDK-B WebUI pozwala uwierzytelnionemu atakującemu na wywołanie odmowy usługi. |
Do wiadomości | 6,5 | 0,31 % | ||
| Dereferencja wskaźnika null w IBM AIX i PowerVM VIOS może prowadzić do odmowy usługi. | Dereferencja wskaźnika null w IBM AIX i PowerVM VIOS może prowadzić do odmowy usługi. |
Do wiadomości | 6,5 | 0,31 % | ||
| Luka w systemie aktywacji licencji pozwala zdalnym atakującym na ominięcie autoryzacji płatności. | Luka w systemie aktywacji licencji pozwala zdalnym atakującym na ominięcie autoryzacji płatności. |
Do wiadomości | 6,5 | 0,31 % | ||
| Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64… |
Do wiadomości | 6,5 | 0,31 % | ||
| Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak sensitive information… | Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Do wiadomości | 6,5 | 0,31 % | ||
| Incorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a… | Incorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Do wiadomości | 6,5 | 0,31 % | ||
| Incorrect authorization in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a… | Incorrect authorization in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Do wiadomości | 6,5 | 0,31 % | ||
| Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a… | Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Do wiadomości | 6,5 | 0,31 % | ||
| The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public… | The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and… |
Do wiadomości | 6,5 | 0,31 % | ||
| An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a… | An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a shared FortiGate device via crafted HTTP requests. |
Do wiadomości | 6,5 | 0,31 % | ||
| Przepełnienie bufora w IBM DB2 High Performance Unload może prowadzić do awarii programu. | Przepełnienie bufora w IBM DB2 High Performance Unload może prowadzić do awarii programu. |
Do wiadomości | 6,5 | 0,31 % | ||
| IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to… | IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due to the incorrect calculation of the size of the data that is being pointed to. |
Do wiadomości | 6,5 | 0,31 % | ||
| Błąd zapisu poza granicami w IBM DB2 High Performance Unload może prowadzić do awarii programu. | Błąd zapisu poza granicami w IBM DB2 High Performance Unload może prowadzić do awarii programu. |
Do wiadomości | 6,5 | 0,31 % | ||
| IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0… | IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could… |
Do wiadomości | 6,5 | 0,31 % | ||
| When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per… | When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of… |
Do wiadomości | 6,5 | 0,31 % | ||
| The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its… | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks. |
Do wiadomości | 6,5 | 0,31 % | ||
| JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows… | JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata… |
Do wiadomości | 6,5 | 0,3 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.