KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Brak autoryzacji w LoginWP - Pro umożliwia dostęp do funkcji bez odpowiednich ograniczeń.
A vulnerability was detected in macrozheng mall up to 1.0.3. Affected by this issue is the function delete of the file /member/readHistory/delete. Performing manipulation of the argument ids results in improper access controls. Remote exploitation of the attack is possible. The exploit is now…
The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taking other instructors' course content…
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass additional authentication workflow steps.
Use of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Wykorzystanie komponentu w IBM Langflow umożliwia odczytanie wrażliwych zmiennych środowiskowych.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ashanjay EventON eventon allows Stored XSS.This issue affects EventON: from n/a through <= 4.9.12.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in p-themes Porto Theme - Functionality porto-functionality allows Stored XSS.This issue affects Porto Theme - Functionality: from n/a through < 3.7.3.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arscode Ninja Popups arscode-ninja-popups allows Stored XSS.This issue affects Ninja Popups: from n/a through <= 4.7.8.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hogash KALLYAS kallyas allows DOM-Based XSS.This issue affects KALLYAS: from n/a through < 4.25.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro Lead Form listingpro-lead-form allows DOM-Based XSS.This issue affects ListingPro Lead Form: from n/a through <= 1.0.7.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam REHub Framework rehub-framework allows Stored XSS.This issue affects REHub Framework: from n/a through < 19.9.9.7.
An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC 7.1 all versions, FortiADC 7.0 all versions, FortiADC 6.2 all versions may allow an admin with read-only permission to get the external resources password…
Brak autoryzacji w Contact Form Email umożliwia nieautoryzowany dostęp do danych.
EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops filtering those fields when per-user ACL application is…
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/{id}/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that…
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can directly fetch a Note through the portal Note API and read an internal stream note when the note identifier is known. Stream list responses correctly hide…
Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for…
Brak autoryzacji w API Apache DolphinScheduler umożliwia nieuprawniony dostęp do danych workflow.
Błąd w weryfikacji artefaktów w Doco-CD pozwala na zastosowanie niezaufanej konfiguracji wdrożenia.
Wyścig warunków w Snipe-IT pozwala na nadmierne przydzielanie zapasów przez równoległe żądania.
Błąd w Snipe-IT umożliwia dostęp do kluczy licencyjnych bez odpowiednich uprawnień.
Błąd w GitPython umożliwia atakującym odczytanie dowolnych ścieżek systemowych.
Wstrzyknięcie argumentów w GFI Exinda AI pozwala na odczyt plików z systemu przez atakującego.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Brak autoryzacji w LoginWP - Pro umożliwia dostęp do funkcji bez odpowiednich ograniczeń. | Brak autoryzacji w LoginWP - Pro umożliwia dostęp do funkcji bez odpowiednich ograniczeń. |
Do wiadomości | 6,5 | 0,23 % | ||
| A vulnerability was detected in macrozheng mall up to 1.0.3. | A vulnerability was detected in macrozheng mall up to 1.0.3. Affected by this issue is the function delete of the file /member/readHistory/delete. Performing manipulation of the argument ids results in improper access controls. Remote exploitation of the attack is possible. The exploit is now… |
Do wiadomości | 6,5 | 0,23 % | ||
| The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a… | The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taking other instructors' course content… |
Do wiadomości | 6,5 | 0,23 % | ||
| IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated… | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass additional authentication workflow steps. |
Do wiadomości | 6,5 | 0,23 % | ||
| Use of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer… | Use of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Do wiadomości | 6,5 | 0,23 % | ||
| Wykorzystanie komponentu w IBM Langflow umożliwia odczytanie wrażliwych zmiennych środowiskowych. | Wykorzystanie komponentu w IBM Langflow umożliwia odczytanie wrażliwych zmiennych środowiskowych. |
Do wiadomości | 6,5 | 0,23 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ashanjay EventON eventon allows… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ashanjay EventON eventon allows Stored XSS.This issue affects EventON: from n/a through <= 4.9.12. |
Do wiadomości | 6,5 | 0,23 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in p-themes Porto Theme - Functionality… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in p-themes Porto Theme - Functionality porto-functionality allows Stored XSS.This issue affects Porto Theme - Functionality: from n/a through < 3.7.3. |
Do wiadomości | 6,5 | 0,23 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arscode Ninja Popups… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arscode Ninja Popups arscode-ninja-popups allows Stored XSS.This issue affects Ninja Popups: from n/a through <= 4.7.8. |
Do wiadomości | 6,5 | 0,23 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hogash KALLYAS kallyas allows… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hogash KALLYAS kallyas allows DOM-Based XSS.This issue affects KALLYAS: from n/a through < 4.25.0. |
Do wiadomości | 6,5 | 0,23 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro Lead Form… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro Lead Form listingpro-lead-form allows DOM-Based XSS.This issue affects ListingPro Lead Form: from n/a through <= 1.0.7. |
Do wiadomości | 6,5 | 0,23 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam REHub Framework… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam REHub Framework rehub-framework allows Stored XSS.This issue affects REHub Framework: from n/a through < 19.9.9.7. |
Do wiadomości | 6,5 | 0,23 % | ||
| An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions,… | An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC 7.1 all versions, FortiADC 7.0 all versions, FortiADC 6.2 all versions may allow an admin with read-only permission to get the external resources password… |
Do wiadomości | 6,5 | 0,23 % | ||
| Brak autoryzacji w Contact Form Email umożliwia nieautoryzowany dostęp do danych. | Brak autoryzacji w Contact Form Email umożliwia nieautoryzowany dostęp do danych. |
Do wiadomości | 6,5 | 0,23 % | ||
| EspoCRM is an open source customer relationship management application. | EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops filtering those fields when per-user ACL application is… |
Do wiadomości | 6,5 | 0,23 % | ||
| EspoCRM is an open source customer relationship management application. | EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/{id}/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that… |
Do wiadomości | 6,5 | 0,23 % | ||
| EspoCRM is an open source customer relationship management application. | EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can directly fetch a Note through the portal Note API and read an internal stream note when the note identifier is known. Stream list responses correctly hide… |
Do wiadomości | 6,5 | 0,23 % | ||
| Denial-of-service in the Storage: StorageManager component. | Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
Do wiadomości | 6,5 | 0,23 % | ||
| The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all… | The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for… |
Do wiadomości | 6,5 | 0,23 % | ||
| Brak autoryzacji w API Apache DolphinScheduler umożliwia nieuprawniony dostęp do danych workflow. | Brak autoryzacji w API Apache DolphinScheduler umożliwia nieuprawniony dostęp do danych workflow. |
Do wiadomości | 6,5 | 0,23 % | ||
| Błąd w weryfikacji artefaktów w Doco-CD pozwala na zastosowanie niezaufanej konfiguracji wdrożenia. | Błąd w weryfikacji artefaktów w Doco-CD pozwala na zastosowanie niezaufanej konfiguracji wdrożenia. |
Do wiadomości | 6,5 | 0,23 % | ||
| Wyścig warunków w Snipe-IT pozwala na nadmierne przydzielanie zapasów przez równoległe żądania. | Wyścig warunków w Snipe-IT pozwala na nadmierne przydzielanie zapasów przez równoległe żądania. |
Do wiadomości | 6,5 | 0,23 % | ||
| Błąd w Snipe-IT umożliwia dostęp do kluczy licencyjnych bez odpowiednich uprawnień. | Błąd w Snipe-IT umożliwia dostęp do kluczy licencyjnych bez odpowiednich uprawnień. |
Do wiadomości | 6,5 | 0,23 % | ||
| Błąd w GitPython umożliwia atakującym odczytanie dowolnych ścieżek systemowych. | Błąd w GitPython umożliwia atakującym odczytanie dowolnych ścieżek systemowych. |
Do wiadomości | 6,5 | 0,23 % | ||
| Wstrzyknięcie argumentów w GFI Exinda AI pozwala na odczyt plików z systemu przez atakującego. | Wstrzyknięcie argumentów w GFI Exinda AI pozwala na odczyt plików z systemu przez atakującego. |
Do wiadomości | 6,5 | 0,23 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.