Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other users, including search query text, job…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in deprecated kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Missing authorization in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low)
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other users, including search query text, job…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in deprecated kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Missing authorization in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki