KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to trigger unauthorized pipeline executions by manipulating commits.
Brak weryfikacji uprawnień w wtyczce WP Timetics pozwala na nieautoryzowany dostęp do danych rezerwacji.
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability in the poll duplication endpoint (/api/trpc/polls.duplicate) allows any authenticated user to duplicate polls they do not own by modifying the pollId…
Błąd w insights-core pozwala na ujawnienie haseł w archiwach przesyłanych do console.redhat.com.
Insufficient permission validation in Checkmk versions prior to 2.4.0p17 and 2.3.0p42 allow low-privileged users to view agent information via the REST API, which could lead to information disclosure.
Wstrzyknięcie skryptów w Wp Ultimate Review umożliwia atak XSS.
grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with access to any document on a Grist installation can use a feature for fetching from a URL that is executed on the server. The privileged network access of server-side requests could offer opportunities for attack…
Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14.
Missing Authorization vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 워드프레스 결제 심플페이: from n/a through 5.5.17.
A vulnerability has been found in fit2cloud Halo 2.21.10. Impacted is an unknown function. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure…
Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (the matcher fires) but evades the…
PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete()…
A vulnerability has been found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. This issue affects some unknown processing. Such manipulation leads to cross-site request forgery. The attack may be performed from remote. The exploit has been disclosed…
grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or…
In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to…
An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI.
Wykorzystanie błędu dereferencji wskaźnika NULL w PX4 Autopilot może spowodować awarię kontrolera lotu.
Brak walidacji własności biletów w GestSup pozwala atakującym na odczyt prywatnych komentarzy.
Brak kontroli autoryzacji w mall4j pozwala atakującym na dostęp do danych adresowych klientów.
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via…
Wtyczka GamiPress w WordPressie jest podatna na wstrzyknięcie SQL przez zalogowanych użytkowników.
Denial of service w Consul umożliwia wyczerpanie pamięci serwera przez uwierzytelnionego klienta.
Błędne neutralizowanie elementów w MongoDB dla Laravel pozwala na nieautoryzowany dostęp do dokumentów.
Błąd use-after-free w LIVE555 Streaming Media umożliwia atakującym wywołanie Denial of Service.
Brak wymuszenia autoryzacji w Snipe-IT pozwala na nieautoryzowane przypisanie aktywów.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1… | GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to trigger unauthorized pipeline executions by manipulating commits. |
Do wiadomości | 6,5 | 0,25 % | ||
| Brak weryfikacji uprawnień w wtyczce WP Timetics pozwala na nieautoryzowany dostęp do danych rezerwacji. | Brak weryfikacji uprawnień w wtyczce WP Timetics pozwala na nieautoryzowany dostęp do danych rezerwacji. |
Do wiadomości | 6,5 | 0,24 % | ||
| Rallly is an open-source scheduling and collaboration tool. | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability in the poll duplication endpoint (/api/trpc/polls.duplicate) allows any authenticated user to duplicate polls they do not own by modifying the pollId… |
Do wiadomości | 6,5 | 0,24 % | ||
| Błąd w insights-core pozwala na ujawnienie haseł w archiwach przesyłanych do console.redhat.com. | Błąd w insights-core pozwala na ujawnienie haseł w archiwach przesyłanych do console.redhat.com. |
Do wiadomości | 6,5 | 0,24 % | ||
| Insufficient permission validation in Checkmk versions prior to 2.4.0p17 and 2.3.0p42 allow low-privileged users to view agent information… | Insufficient permission validation in Checkmk versions prior to 2.4.0p17 and 2.3.0p42 allow low-privileged users to view agent information via the REST API, which could lead to information disclosure. |
Do wiadomości | 6,5 | 0,24 % | ||
| Wstrzyknięcie skryptów w Wp Ultimate Review umożliwia atak XSS. | Wstrzyknięcie skryptów w Wp Ultimate Review umożliwia atak XSS. |
Do wiadomości | 6,5 | 0,24 % | ||
| grist-core is a spreadsheet hosting server. | grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with access to any document on a Grist installation can use a feature for fetching from a URL that is executed on the server. The privileged network access of server-side requests could offer opportunities for attack… |
Do wiadomości | 6,5 | 0,24 % | ||
| Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured… | Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14. |
Do wiadomości | 6,5 | 0,24 % | ||
| Missing Authorization vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows Exploiting Incorrectly Configured Access… | Missing Authorization vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 워드프레스 결제 심플페이: from n/a through 5.5.17. |
Do wiadomości | 6,5 | 0,24 % | ||
| A vulnerability has been found in fit2cloud Halo 2.21.10. | A vulnerability has been found in fit2cloud Halo 2.21.10. Impacted is an unknown function. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure… |
Do wiadomości | 6,5 | 0,24 % | ||
| Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a… | Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (the matcher fires) but evades the… |
Do wiadomości | 6,5 | 0,24 % | ||
| PyJWT is a Python implementation of JSON Web Token standards. | PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete()… |
Do wiadomości | 6,5 | 0,24 % | ||
| A vulnerability has been found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. | A vulnerability has been found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. This issue affects some unknown processing. Such manipulation leads to cross-site request forgery. The attack may be performed from remote. The exploit has been disclosed… |
Do wiadomości | 6,5 | 0,24 % | ||
| grist-core is a spreadsheet hosting server. | grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or… |
Do wiadomości | 6,5 | 0,24 % | ||
| In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters,… | In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to… |
Do wiadomości | 6,5 | 0,24 % | ||
| An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user… | An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI. |
Do wiadomości | 6,5 | 0,24 % | ||
| Wykorzystanie błędu dereferencji wskaźnika NULL w PX4 Autopilot może spowodować awarię kontrolera lotu. | Wykorzystanie błędu dereferencji wskaźnika NULL w PX4 Autopilot może spowodować awarię kontrolera lotu. |
Do wiadomości | 6,5 | 0,24 % | ||
| Brak walidacji własności biletów w GestSup pozwala atakującym na odczyt prywatnych komentarzy. | Brak walidacji własności biletów w GestSup pozwala atakującym na odczyt prywatnych komentarzy. |
Do wiadomości | 6,5 | 0,24 % | ||
| Brak kontroli autoryzacji w mall4j pozwala atakującym na dostęp do danych adresowych klientów. | Brak kontroli autoryzacji w mall4j pozwala atakującym na dostęp do danych adresowych klientów. |
Do wiadomości | 6,5 | 0,24 % | ||
| Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated… | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via… |
Do wiadomości | 6,5 | 0,24 % | ||
| Wtyczka GamiPress w WordPressie jest podatna na wstrzyknięcie SQL przez zalogowanych użytkowników. | Wtyczka GamiPress w WordPressie jest podatna na wstrzyknięcie SQL przez zalogowanych użytkowników. |
Do wiadomości | 6,5 | 0,24 % | ||
| Denial of service w Consul umożliwia wyczerpanie pamięci serwera przez uwierzytelnionego klienta. | Denial of service w Consul umożliwia wyczerpanie pamięci serwera przez uwierzytelnionego klienta. |
Do wiadomości | 6,5 | 0,24 % | ||
| Błędne neutralizowanie elementów w MongoDB dla Laravel pozwala na nieautoryzowany dostęp do dokumentów. | Błędne neutralizowanie elementów w MongoDB dla Laravel pozwala na nieautoryzowany dostęp do dokumentów. |
Do wiadomości | 6,5 | 0,24 % | ||
| Błąd use-after-free w LIVE555 Streaming Media umożliwia atakującym wywołanie Denial of Service. | Błąd use-after-free w LIVE555 Streaming Media umożliwia atakującym wywołanie Denial of Service. |
Do wiadomości | 6,5 | 0,24 % | ||
| Brak wymuszenia autoryzacji w Snipe-IT pozwala na nieautoryzowane przypisanie aktywów. | Brak wymuszenia autoryzacji w Snipe-IT pozwala na nieautoryzowane przypisanie aktywów. |
Do wiadomości | 6,5 | 0,24 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.