KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Refleksyjny atak XSS w wtyczce CBX 5 Star Rating umożliwia wstrzyknięcie skryptów przez nieautoryzowanych użytkowników.
Luka otwartego przekierowania w Directus pozwala na przekierowanie użytkowników na dowolne zewnętrzne domeny.
Przepełnienie bufora w GNU Binutils może prowadzić do ujawnienia wrażliwych danych lub awarii aplikacji, co skutkuje odmową usługi.
Luka w SSO SAML 2.0 w Cisco Secure Firewall umożliwia atak XSS i dostęp do danych przeglądarki.
Luka w Cisco Secure Firewall umożliwia atak XSS przez nieautoryzowanego użytkownika.
Cross Site Scripting w nopCommerce pozwala na wykonanie złośliwego kodu przy przeglądaniu stron.
Due to a Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is processed during web page generation, resulting…
Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious scripts that execute in the context of other users� browsers, allowing the attacker to steal session cookies, tokens, and other sensitive information. As a…
Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally.
Brak sanitizacji w wtyczce WP Photo Album Plus umożliwia ataki XSS na użytkowników.
The VikRentItems Flexible Rental Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'delto' parameter in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
The Like DisLike Voting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
Wtyczka Simple AL Slider dla WordPressa jest podatna na refleksywne XSS, co umożliwia atakującym wstrzykiwanie skryptów.
The myLCO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 0.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary…
The Jabbernotification plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the admin.php PATH_INFO in all versions up to, and including, 0.99-RC2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
The Twitscription plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the admin.php PATH_INFO in all versions up to, and including, 0.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
The WP-SOS-Donate Donation Sidebar Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 0.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order_by' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary…
The Job Board by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.1. This is due to the plugin storing the entire unsanitized `$_GET` superglobal array directly into the database via `update_user_meta()` when users save search…
The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts…
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
W OpenCTI podatność na otwarte przekierowanie w punkcie końcowym SAML umożliwia phishing i kradzież danych.
Astro is a web framework. Prior to version 5.15.9, when using Astro's Cloudflare adapter (@astrojs/cloudflare) with output: 'server', the image optimization endpoint (/_image) contains a critical vulnerability in the isRemoteAllowed() function that unconditionally allows data: protocol URLs. This…
Otwarte przekierowanie w Movary umożliwia phishing poprzez złośliwe linki.
A security vulnerability has been detected in Qualitor up to 8.24.73. The impacted element is an unknown function of the file /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php. Such manipulation of the argument cdscript leads to cross site scripting. It is possible to launch the…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Refleksyjny atak XSS w wtyczce CBX 5 Star Rating umożliwia wstrzyknięcie skryptów przez nieautoryzowanych użytkowników. | Refleksyjny atak XSS w wtyczce CBX 5 Star Rating umożliwia wstrzyknięcie skryptów przez nieautoryzowanych użytkowników. |
Do wiadomości | 6,1 | 0,26 % | ||
| Luka otwartego przekierowania w Directus pozwala na przekierowanie użytkowników na dowolne zewnętrzne domeny. | Luka otwartego przekierowania w Directus pozwala na przekierowanie użytkowników na dowolne zewnętrzne domeny. |
Do wiadomości | 6,1 | 0,26 % | ||
| Przepełnienie bufora w GNU Binutils może prowadzić do ujawnienia wrażliwych danych lub awarii aplikacji, co skutkuje odmową usługi. | Przepełnienie bufora w GNU Binutils może prowadzić do ujawnienia wrażliwych danych lub awarii aplikacji, co skutkuje odmową usługi. |
Do wiadomości | 6,1 | 0,26 % | ||
| Luka w SSO SAML 2.0 w Cisco Secure Firewall umożliwia atak XSS i dostęp do danych przeglądarki. | Luka w SSO SAML 2.0 w Cisco Secure Firewall umożliwia atak XSS i dostęp do danych przeglądarki. |
Do wiadomości | 6,1 | 0,26 % | ||
| Luka w Cisco Secure Firewall umożliwia atak XSS przez nieautoryzowanego użytkownika. | Luka w Cisco Secure Firewall umożliwia atak XSS przez nieautoryzowanego użytkownika. |
Do wiadomości | 6,1 | 0,26 % | ||
| Cross Site Scripting w nopCommerce pozwala na wykonanie złośliwego kodu przy przeglądaniu stron. | Cross Site Scripting w nopCommerce pozwala na wykonanie złośliwego kodu przy przeglądaniu stron. |
Do wiadomości | 6,1 | 0,26 % | ||
| Due to a Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could generate a… | Due to a Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is processed during web page generation, resulting… |
Do wiadomości | 6,1 | 0,26 % | ||
| Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious… | Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious scripts that execute in the context of other users� browsers, allowing the attacker to steal session cookies, tokens, and other sensitive information. As a… |
Do wiadomości | 6,1 | 0,26 % | ||
| Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally. | Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally. |
Do wiadomości | 6,1 | 0,26 % | ||
| Brak sanitizacji w wtyczce WP Photo Album Plus umożliwia ataki XSS na użytkowników. | Brak sanitizacji w wtyczce WP Photo Album Plus umożliwia ataki XSS na użytkowników. |
Do wiadomości | 6,1 | 0,26 % | ||
| The VikRentItems Flexible Rental Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'delto'… | The VikRentItems Flexible Rental Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'delto' parameter in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated… |
Do wiadomości | 6,1 | 0,26 % | ||
| The Like DisLike Voting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in… | The Like DisLike Voting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to… |
Do wiadomości | 6,1 | 0,26 % | ||
| Wtyczka Simple AL Slider dla WordPressa jest podatna na refleksywne XSS, co umożliwia atakującym wstrzykiwanie skryptów. | Wtyczka Simple AL Slider dla WordPressa jest podatna na refleksywne XSS, co umożliwia atakującym wstrzykiwanie skryptów. |
Do wiadomości | 6,1 | 0,26 % | ||
| The myLCO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up… | The myLCO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 0.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary… |
Do wiadomości | 6,1 | 0,26 % | ||
| The Jabbernotification plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the admin.php PATH_INFO in all versions up… | The Jabbernotification plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the admin.php PATH_INFO in all versions up to, and including, 0.99-RC2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject… |
Do wiadomości | 6,1 | 0,26 % | ||
| The Twitscription plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the admin.php PATH_INFO in all versions up to,… | The Twitscription plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the admin.php PATH_INFO in all versions up to, and including, 0.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web… |
Do wiadomości | 6,1 | 0,26 % | ||
| The WP-SOS-Donate Donation Sidebar Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']`… | The WP-SOS-Donate Donation Sidebar Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 0.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated… |
Do wiadomości | 6,1 | 0,26 % | ||
| The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order_by' parameter in all versions up… | The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order_by' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary… |
Do wiadomości | 6,1 | 0,26 % | ||
| The Job Board by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.1. | The Job Board by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.1. This is due to the plugin storing the entire unsanitized `$_GET` superglobal array directly into the database via `update_user_meta()` when users save search… |
Do wiadomości | 6,1 | 0,26 % | ||
| The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and… | The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts… |
Do wiadomości | 6,1 | 0,26 % | ||
| The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’… | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated… |
Do wiadomości | 6,1 | 0,26 % | ||
| W OpenCTI podatność na otwarte przekierowanie w punkcie końcowym SAML umożliwia phishing i kradzież danych. | W OpenCTI podatność na otwarte przekierowanie w punkcie końcowym SAML umożliwia phishing i kradzież danych. |
Do wiadomości | 6,1 | 0,26 % | ||
| Astro is a web framework. | Astro is a web framework. Prior to version 5.15.9, when using Astro's Cloudflare adapter (@astrojs/cloudflare) with output: 'server', the image optimization endpoint (/_image) contains a critical vulnerability in the isRemoteAllowed() function that unconditionally allows data: protocol URLs. This… |
Do wiadomości | 6,1 | 0,26 % | ||
| Otwarte przekierowanie w Movary umożliwia phishing poprzez złośliwe linki. | Otwarte przekierowanie w Movary umożliwia phishing poprzez złośliwe linki. |
Do wiadomości | 6,1 | 0,26 % | ||
| A security vulnerability has been detected in Qualitor up to 8.24.73. | A security vulnerability has been detected in Qualitor up to 8.24.73. The impacted element is an unknown function of the file /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php. Such manipulation of the argument cdscript leads to cross site scripting. It is possible to launch the… |
Do wiadomości | 6,1 | 0,25 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.