KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Błąd walidacji w Claude Code umożliwia atakującym omijanie ograniczeń zapisu do wrażliwych katalogów.
Błąd w Discourse pozwala moderatorom na dostęp do wrażliwych danych w logach działań.
Wstawienie wrażliwych danych do wysyłanych informacji w AweBooking umożliwia ich odzyskanie.
Wstrzyknięcie wrażliwych informacji w weDevs WP Project Manager umożliwia ich odzyskanie.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in averta Master Slider Pro masterslider allows DOM-Based XSS.This issue affects Master Slider Pro: from n/a through <= 3.7.12.
The Meta Tag Manager WordPress plugin before 3.3 does not restrict which roles can create http-equiv refresh meta tags.
Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
A stack-based buffer overflow was found in rpcbind's rpcinfo utility. In rpcbdump() short mode (used by `rpcinfo -s`), version numbers from a remote RPCBPROC_DUMP reply are written into a fixed-size stack buffer without bounds checking. A user or administrator who runs `rpcinfo -s` against a…
Błąd w aplikacji Mattermost Desktop umożliwia zdalne wykonanie kodu przez złośliwy serwer.
The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one…
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails to enforce the necessary authorization checks before…
Wtyczka QSM dla WordPressa jest podatna na SQL Injection, co pozwala na wyciek danych.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons allows Stored XSS.This issue affects Tutor LMS Elementor Addons: from n/a through <= 3.0.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows DOM-Based XSS.This issue affects Xpro Elementor Addons: from n/a through <= 1.4.19.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro listingpro-plugin allows DOM-Based XSS.This issue affects ListingPro: from n/a through <= 2.9.9.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nasir Uddin Generic Elements generic-elements-for-elementor allows Stored XSS.This issue affects Generic Elements: from n/a through <= 1.2.9.
The Perfect Brands for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the `brands` attribute of the `products` shortcode in all versions up to, and including, 3.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the…
Wycieki informacji w Storage w Google Chrome umożliwiają zdalnemu atakującemu odczyt/zapis danych.
Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through <= 3.4.8.
Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the IMAP, SMTP and POP3 services, or the webmail, unavailable by sending a message. The server unfolded a decoded header…
Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message.…
Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders a…
Nieprawidłowo zabezpieczone API w Fudo Enterprise umożliwia dostęp do zasobów administratora.
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Błąd walidacji w Claude Code umożliwia atakującym omijanie ograniczeń zapisu do wrażliwych katalogów. | Błąd walidacji w Claude Code umożliwia atakującym omijanie ograniczeń zapisu do wrażliwych katalogów. |
Do wiadomości | 6,5 | 0,26 % | ||
| Błąd w Discourse pozwala moderatorom na dostęp do wrażliwych danych w logach działań. | Błąd w Discourse pozwala moderatorom na dostęp do wrażliwych danych w logach działań. |
Do wiadomości | 6,5 | 0,26 % | ||
| Wstawienie wrażliwych danych do wysyłanych informacji w AweBooking umożliwia ich odzyskanie. | Wstawienie wrażliwych danych do wysyłanych informacji w AweBooking umożliwia ich odzyskanie. |
Do wiadomości | 6,5 | 0,26 % | ||
| Wstrzyknięcie wrażliwych informacji w weDevs WP Project Manager umożliwia ich odzyskanie. | Wstrzyknięcie wrażliwych informacji w weDevs WP Project Manager umożliwia ich odzyskanie. |
Do wiadomości | 6,5 | 0,26 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in averta Master Slider Pro… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in averta Master Slider Pro masterslider allows DOM-Based XSS.This issue affects Master Slider Pro: from n/a through <= 3.7.12. |
Do wiadomości | 6,5 | 0,26 % | ||
| The Meta Tag Manager WordPress plugin before 3.3 does not restrict which roles can create http-equiv refresh meta tags. | The Meta Tag Manager WordPress plugin before 3.3 does not restrict which roles can create http-equiv refresh meta tags. |
Do wiadomości | 6,5 | 0,26 % | ||
| Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin… | Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
Do wiadomości | 6,5 | 0,26 % | ||
| Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a… | Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
Do wiadomości | 6,5 | 0,26 % | ||
| A stack-based buffer overflow was found in rpcbind's rpcinfo utility. | A stack-based buffer overflow was found in rpcbind's rpcinfo utility. In rpcbdump() short mode (used by `rpcinfo -s`), version numbers from a remote RPCBPROC_DUMP reply are written into a fixed-size stack buffer without bounds checking. A user or administrator who runs `rpcinfo -s` against a… |
Do wiadomości | 6,5 | 0,26 % | ||
| Błąd w aplikacji Mattermost Desktop umożliwia zdalne wykonanie kodu przez złośliwy serwer. | Błąd w aplikacji Mattermost Desktop umożliwia zdalne wykonanie kodu przez złośliwy serwer. |
Do wiadomości | 6,5 | 0,26 % | ||
| The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to… | The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one… |
Do wiadomości | 6,5 | 0,26 % | ||
| An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through… | An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails to enforce the necessary authorization checks before… |
Do wiadomości | 6,5 | 0,26 % | ||
| Wtyczka QSM dla WordPressa jest podatna na SQL Injection, co pozwala na wyciek danych. | Wtyczka QSM dla WordPressa jest podatna na SQL Injection, co pozwala na wyciek danych. |
Do wiadomości | 6,5 | 0,26 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS Elementor Addons… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons allows Stored XSS.This issue affects Tutor LMS Elementor Addons: from n/a through <= 3.0.1. |
Do wiadomości | 6,5 | 0,26 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows DOM-Based XSS.This issue affects Xpro Elementor Addons: from n/a through <= 1.4.19.1. |
Do wiadomości | 6,5 | 0,26 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro listingpro-plugin allows DOM-Based XSS.This issue affects ListingPro: from n/a through <= 2.9.9. |
Do wiadomości | 6,5 | 0,26 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nasir Uddin Generic Elements… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nasir Uddin Generic Elements generic-elements-for-elementor allows Stored XSS.This issue affects Generic Elements: from n/a through <= 1.2.9. |
Do wiadomości | 6,5 | 0,26 % | ||
| The Perfect Brands for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the `brands` attribute of the… | The Perfect Brands for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the `brands` attribute of the `products` shortcode in all versions up to, and including, 3.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the… |
Do wiadomości | 6,5 | 0,26 % | ||
| Wycieki informacji w Storage w Google Chrome umożliwiają zdalnemu atakującemu odczyt/zapis danych. | Wycieki informacji w Storage w Google Chrome umożliwiają zdalnemu atakującemu odczyt/zapis danych. |
Do wiadomości | 6,5 | 0,26 % | ||
| Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom.This issue affects… | Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through <= 3.4.8. |
Do wiadomości | 6,5 | 0,26 % | ||
| Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a… | Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the IMAP, SMTP and POP3 services, or the webmail, unavailable by sending a message. The server unfolded a decoded header… |
Do wiadomości | 6,5 | 0,26 % | ||
| Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of… | Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message.… |
Do wiadomości | 6,5 | 0,26 % | ||
| Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5… | Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders a… |
Do wiadomości | 6,5 | 0,26 % | ||
| Nieprawidłowo zabezpieczone API w Fudo Enterprise umożliwia dostęp do zasobów administratora. | Nieprawidłowo zabezpieczone API w Fudo Enterprise umożliwia dostęp do zasobów administratora. |
Do wiadomości | 6,5 | 0,26 % | ||
| The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. | The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the… |
Do wiadomości | 6,5 | 0,26 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.