KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
IBM watsonx.data 2.2 through 2.2.1 could allow an authenticated user to cause a denial of service through ingestion pods due to improper allocation of resources without limits.
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a denial of service due to improper validation of a specified quantity size input.
An issue was discovered in Logpoint before 7.7.0. Sensitive information is exposed in System Processes for an extended period during high CPU load.
Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.
Błąd walidacji wejścia w Modem może prowadzić do zdalnego odmowy usługi.
Błędna kontrola dostępu w usłudze Identity Provider w usememos umożliwia przejęcie konta.
Wykonanie dowolnego kodu w Management Server API w XProtect® przez użytkowników z uprawnieniami edycji.
Missing authorization in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via UI Interaction. (Chromium security severity: Medium)
Błędna autoryzacja w TabGroups w Google Chrome umożliwia zdalnemu atakującemu wyciek danych.
Luka w Helidon umożliwia nieautoryzowany dostęp do krytycznych danych przez atakującego.
Luka w Oracle Hyperion Financial Reporting umożliwia nieautoryzowany dostęp do danych.
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to…
Luka w PeopleSoft umożliwia nieautoryzowany dostęp do krytycznych danych.
Słaba polityka haseł w HCL MyCloud zwiększa ryzyko przejęcia konta.
A security flaw has been discovered in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. The affected element is an unknown function of the file /details.php. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The…
Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to…
Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after…
The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL…
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition undergoing iSCSI SAN…
Luka w wtyczce Xpro Elementor Addons - Pro pozwala na odczyt dowolnych plików przez uwierzytelnionych atakujących.
SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. An attacker can trigger controlled delays using SQL SLEEP() to infer database contents. Successful exploitation may lead to full database compromise, especially…
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized…
The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it…
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| IBM watsonx.data 2.2 through 2.2.1 could allow an authenticated user to cause a denial of service through ingestion pods due to improper… | IBM watsonx.data 2.2 through 2.2.1 could allow an authenticated user to cause a denial of service through ingestion pods due to improper allocation of resources without limits. |
Do wiadomości | 6,5 | 0,29 % | ||
| IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a… | IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a denial of service due to improper validation of a specified quantity size input. |
Do wiadomości | 6,5 | 0,29 % | ||
| An issue was discovered in Logpoint before 7.7.0. | An issue was discovered in Logpoint before 7.7.0. Sensitive information is exposed in System Processes for an extended period during high CPU load. |
Do wiadomości | 6,5 | 0,29 % | ||
| Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker… | Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium) |
Do wiadomości | 6,5 | 0,28 % | ||
| An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. | An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com. |
Do wiadomości | 6,5 | 0,28 % | ||
| Błąd walidacji wejścia w Modem może prowadzić do zdalnego odmowy usługi. | Błąd walidacji wejścia w Modem może prowadzić do zdalnego odmowy usługi. |
Do wiadomości | 6,5 | 0,28 % | ||
| Błędna kontrola dostępu w usłudze Identity Provider w usememos umożliwia przejęcie konta. | Błędna kontrola dostępu w usłudze Identity Provider w usememos umożliwia przejęcie konta. |
Do wiadomości | 6,5 | 0,28 % | ||
| Wykonanie dowolnego kodu w Management Server API w XProtect® przez użytkowników z uprawnieniami edycji. | Wykonanie dowolnego kodu w Management Server API w XProtect® przez użytkowników z uprawnieniami edycji. |
Do wiadomości | 6,4 | 0,78 % | ||
| Missing authorization in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to… | Missing authorization in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via UI Interaction. (Chromium security severity: Medium) |
Do wiadomości | 6,5 | 0,28 % | ||
| Błędna autoryzacja w TabGroups w Google Chrome umożliwia zdalnemu atakującemu wyciek danych. | Błędna autoryzacja w TabGroups w Google Chrome umożliwia zdalnemu atakującemu wyciek danych. |
Do wiadomości | 6,5 | 0,28 % | ||
| Luka w Helidon umożliwia nieautoryzowany dostęp do krytycznych danych przez atakującego. | Luka w Helidon umożliwia nieautoryzowany dostęp do krytycznych danych przez atakującego. |
Do wiadomości | 6,5 | 0,28 % | ||
| Luka w Oracle Hyperion Financial Reporting umożliwia nieautoryzowany dostęp do danych. | Luka w Oracle Hyperion Financial Reporting umożliwia nieautoryzowany dostęp do danych. |
Do wiadomości | 6,5 | 0,28 % | ||
| Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to… |
Do wiadomości | 6,5 | 0,28 % | ||
| Luka w PeopleSoft umożliwia nieautoryzowany dostęp do krytycznych danych. | Luka w PeopleSoft umożliwia nieautoryzowany dostęp do krytycznych danych. |
Do wiadomości | 6,5 | 0,28 % | ||
| Słaba polityka haseł w HCL MyCloud zwiększa ryzyko przejęcia konta. | Słaba polityka haseł w HCL MyCloud zwiększa ryzyko przejęcia konta. |
Do wiadomości | 6,5 | 0,28 % | ||
| A security flaw has been discovered in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. | A security flaw has been discovered in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. The affected element is an unknown function of the file /details.php. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The… |
Do wiadomości | 6,5 | 0,28 % | ||
| Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after… | Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to… |
Do wiadomości | 6,5 | 0,28 % | ||
| Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving… | Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after… |
Do wiadomości | 6,5 | 0,28 % | ||
| The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts… | The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL… |
Do wiadomości | 6,5 | 0,28 % | ||
| IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a… | IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition undergoing iSCSI SAN… |
Do wiadomości | 6,5 | 0,28 % | ||
| Luka w wtyczce Xpro Elementor Addons - Pro pozwala na odczyt dowolnych plików przez uwierzytelnionych atakujących. | Luka w wtyczce Xpro Elementor Addons - Pro pozwala na odczyt dowolnych plików przez uwierzytelnionych atakujących. |
Do wiadomości | 6,5 | 0,28 % | ||
| SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. | SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. An attacker can trigger controlled delays using SQL SLEEP() to infer database contents. Successful exploitation may lead to full database compromise, especially… |
Do wiadomości | 6,5 | 0,28 % | ||
| Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image… | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized… |
Do wiadomości | 6,5 | 0,28 % | ||
| The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including,… | The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it… |
Do wiadomości | 6,5 | 0,28 % | ||
| The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode… | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded… |
Do wiadomości | 6,5 | 0,28 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.