KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Wykonanie skryptu w http.cookies.Morsel umożliwia atak XSS przez nieprawidłowe osadzenie skryptu.
Wstrzyknięcie skryptów w punkcie uwierzytelniania umożliwia atakującemu manipulację interfejsem.
Luka Open Redirect w WeGIA pozwala na przekierowanie użytkowników na zewnętrzne strony.
Luka XSS w module komentarzy Emlog umożliwia atakującemu wstrzyknięcie złośliwego skryptu.
W podatnym frameworku Slippers dla Django występuje luka XSS umożliwiająca wstrzyknięcie kodu HTML lub JavaScript.
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached…
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which project owns it. An authenticated user…
By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable to DNS rebinding attacks, which allows…
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'thumb_url' parameter in all versions up to, and including, 1.8.46 due to insufficient input sanitization and output escaping. This makes it possible for…
Brak walidacji parametru gid w LimeSurvey umożliwia atak XSS i kompromitację użytkownika.
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). This issue…
The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative…
Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This…
The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
A HTML Injection vulnerability in the comment section of the project page in MicroStudio 24.01.29 allows remote attackers to inject arbitrary web script or HTML via the text parameter of add_project_comment function.
Barix Instreamer v04.06 and earlier is vulnerable to Cross Site Scripting (XSS) in the Web UI I/O & Serial configuration page, specifically the CTS close command user-input field which is stored and later rendered on the Status page.
SAP S/4HANA landscape SAP E-Recruiting BSP allows an unauthenticated attacker to craft malicious links, when clicked the victim could be redirected to the page controlled by the attacker. This has low impact on confidentiality and integrity of the application with no impact on availability.
Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF' ] in index.php/sysconfig.inc.php, which allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted URL path.
Luka w interfejsie zarządzania Cisco Catalyst Center umożliwia atak XSS przez nieautoryzowanego użytkownika.
The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path (write_debug_logs) reflecting the raw value of $_SERVER['REQUEST_URI'] through vprintf() directly inside a <script>…
A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QuMagie 2.8.1 and later
Wstrzyknięcie skryptów w Combodo iTop umożliwia atak XSS w przypadku błędnych danych.
Wykonanie skryptu w Combodo iTop umożliwia atak typu cross-site scripting.
Wstrzyknięcie skryptów w Combodo iTop pozwala na ataki typu cross-site scripting.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Wykonanie skryptu w http.cookies.Morsel umożliwia atak XSS przez nieprawidłowe osadzenie skryptu. | Wykonanie skryptu w http.cookies.Morsel umożliwia atak XSS przez nieprawidłowe osadzenie skryptu. |
Do wiadomości | 6,1 | 0,23 % | ||
| Wstrzyknięcie skryptów w punkcie uwierzytelniania umożliwia atakującemu manipulację interfejsem. | Wstrzyknięcie skryptów w punkcie uwierzytelniania umożliwia atakującemu manipulację interfejsem. |
Do wiadomości | 6,1 | 0,23 % | ||
| Luka Open Redirect w WeGIA pozwala na przekierowanie użytkowników na zewnętrzne strony. | Luka Open Redirect w WeGIA pozwala na przekierowanie użytkowników na zewnętrzne strony. |
Do wiadomości | 6,1 | 0,23 % | ||
| Luka XSS w module komentarzy Emlog umożliwia atakującemu wstrzyknięcie złośliwego skryptu. | Luka XSS w module komentarzy Emlog umożliwia atakującemu wstrzyknięcie złośliwego skryptu. |
Do wiadomości | 6,1 | 0,23 % | ||
| W podatnym frameworku Slippers dla Django występuje luka XSS umożliwiająca wstrzyknięcie kodu HTML lub JavaScript. | W podatnym frameworku Slippers dla Django występuje luka XSS umożliwiająca wstrzyknięcie kodu HTML lub JavaScript. |
Do wiadomości | 6,1 | 0,23 % | ||
| Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached… |
Do wiadomości | 6,1 | 0,23 % | ||
| n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied… | n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which project owns it. An authenticated user… |
Do wiadomości | 6,1 | 0,23 % | ||
| By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0… | By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable to DNS rebinding attacks, which allows… |
Do wiadomości | 6,1 | 0,23 % | ||
| The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the… | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'thumb_url' parameter in all versions up to, and including, 1.8.46 due to insufficient input sanitization and output escaping. This makes it possible for… |
Do wiadomości | 6,1 | 0,23 % | ||
| Brak walidacji parametru gid w LimeSurvey umożliwia atak XSS i kompromitację użytkownika. | Brak walidacji parametru gid w LimeSurvey umożliwia atak XSS i kompromitację użytkownika. |
Do wiadomości | 6,1 | 0,23 % | ||
| The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in… | The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to… |
Do wiadomości | 6,1 | 0,23 % | ||
| vega-functions provides function implementations for the Vega expression language. | vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). This issue… |
Do wiadomości | 6,1 | 0,23 % | ||
| The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. | The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative… |
Do wiadomości | 6,1 | 0,22 % | ||
| Payload is a free and open source headless content management system. | Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This… |
Do wiadomości | 6,1 | 0,22 % | ||
| The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Parameter Key in all… | The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject… |
Do wiadomości | 6,1 | 0,22 % | ||
| A HTML Injection vulnerability in the comment section of the project page in MicroStudio 24.01.29 allows remote attackers to inject… | A HTML Injection vulnerability in the comment section of the project page in MicroStudio 24.01.29 allows remote attackers to inject arbitrary web script or HTML via the text parameter of add_project_comment function. |
Do wiadomości | 6,1 | 0,22 % | ||
| Barix Instreamer v04.06 and earlier is vulnerable to Cross Site Scripting (XSS) in the Web UI I/O & Serial configuration page,… | Barix Instreamer v04.06 and earlier is vulnerable to Cross Site Scripting (XSS) in the Web UI I/O & Serial configuration page, specifically the CTS close command user-input field which is stored and later rendered on the Status page. |
Do wiadomości | 6,1 | 0,22 % | ||
| SAP S/4HANA landscape SAP E-Recruiting BSP allows an unauthenticated attacker to craft malicious links, when clicked the victim could be… | SAP S/4HANA landscape SAP E-Recruiting BSP allows an unauthenticated attacker to craft malicious links, when clicked the victim could be redirected to the page controlled by the attacker. This has low impact on confidentiality and integrity of the application with no impact on availability. |
Do wiadomości | 6,1 | 0,22 % | ||
| Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF' ] in… | Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF' ] in index.php/sysconfig.inc.php, which allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted URL path. |
Do wiadomości | 6,1 | 0,22 % | ||
| Luka w interfejsie zarządzania Cisco Catalyst Center umożliwia atak XSS przez nieautoryzowanego użytkownika. | Luka w interfejsie zarządzania Cisco Catalyst Center umożliwia atak XSS przez nieautoryzowanego użytkownika. |
Do wiadomości | 6,1 | 0,22 % | ||
| The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. | The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path (write_debug_logs) reflecting the raw value of $_SERVER['REQUEST_URI'] through vprintf() directly inside a <script>… |
Do wiadomości | 6,1 | 0,22 % | ||
| A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. | A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QuMagie 2.8.1 and later |
Do wiadomości | 6,1 | 0,22 % | ||
| Wstrzyknięcie skryptów w Combodo iTop umożliwia atak XSS w przypadku błędnych danych. | Wstrzyknięcie skryptów w Combodo iTop umożliwia atak XSS w przypadku błędnych danych. |
Do wiadomości | 6,1 | 0,22 % | ||
| Wykonanie skryptu w Combodo iTop umożliwia atak typu cross-site scripting. | Wykonanie skryptu w Combodo iTop umożliwia atak typu cross-site scripting. |
Do wiadomości | 6,1 | 0,22 % | ||
| Wstrzyknięcie skryptów w Combodo iTop pozwala na ataki typu cross-site scripting. | Wstrzyknięcie skryptów w Combodo iTop pozwala na ataki typu cross-site scripting. |
Do wiadomości | 6,1 | 0,22 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.