Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/decode_string functions. Attackers can craft or enumerate…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Improper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Advancity ALMS Cloud: through 2026-10-08. NOTE: The vendor was contacted early about this disclosure but did not…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to coerce the service into transmitting data to an arbitrary internal IP address, potentially leaking sensitive information.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam Rehub rehub-theme allows Stored XSS.This issue affects Rehub: from n/a through < 19.9.9.1.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Eduma eduma allows Stored XSS.This issue affects Eduma: from n/a through <= 5.7.6.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Estatik estatik allows DOM-Based XSS.This issue affects Estatik: from n/a through <= 4.3.1.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Konstantin Pankratov Date counter date-counter allows Stored XSS.This issue affects Date counter: from n/a through <= 2.0.3.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Stored XSS.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through <= 1.1.2.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/decode_string functions. Attackers can craft or enumerate…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Improper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Advancity ALMS Cloud: through 2026-10-08. NOTE: The vendor was contacted early about this disclosure but did not…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to coerce the service into transmitting data to an arbitrary internal IP address, potentially leaking sensitive information.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam Rehub rehub-theme allows Stored XSS.This issue affects Rehub: from n/a through < 19.9.9.1.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Eduma eduma allows Stored XSS.This issue affects Eduma: from n/a through <= 5.7.6.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Estatik estatik allows DOM-Based XSS.This issue affects Estatik: from n/a through <= 4.3.1.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Konstantin Pankratov Date counter date-counter allows Stored XSS.This issue affects Date counter: from n/a through <= 2.0.3.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Stored XSS.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through <= 1.1.2.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,2 % · rekomendacja wg zapisanej polityki