KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Stored cross-site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF file.
Reflected XSS w Shopware umożliwia atakującym wstrzyknięcie kodu przez niezabezpieczony parametr URL, co może prowadzić do kradzieży sesji.
Reflected Cross-Site Scripting (XSS) in IDI Eikon's Governalia. The vulnerability allows an attacker to execute JavaScript code in the victim's browser when a malicious URL with the 'q' parameter in '/search' is sent to them. This vulnerability can be exploited to steal sensitive information such…
An issue was discovered in Logpoint before 7.7.0. Insufficient input validation and a lack of output escaping in multiple components leads to a cross-site scripting (XSS) vulnerability.
Cross-site scripting vulnerability exists in SNC-CX600W all versions. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the product.
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APP_CLOUDFLARE_IS_USED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an…
Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field.
Przepełnienie bufora w GNU coreutils unexpand umożliwia zdalne wykonanie kodu.
Luka XSS w sterowniku uwierzytelniania OpenNebula pozwala na wykonanie dowolnych skryptów webowych.
Wrażliwość XSS w OpenNebula umożliwia atakującym wykonanie dowolnych skryptów webowych.
Wrażliwość XSS w OpenNebula umożliwia atakującym wykonywanie dowolnych skryptów webowych.
Wstrzyknięcie skryptów XSS w OpenNebula umożliwia wykonanie dowolnych skryptów webowych.
A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to execute arbitrary code with root privileges. This vulnerability is due to insufficient boundary checks for specific data that is…
IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or Markdown formatting, this was rendered as HTML…
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards…
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are…
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.
Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: High)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Seres Software syWEB allows Reflected XSS. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported.
The virtio PCI driver (drivers/virtio/virtio_pci.c) parses a device's PCI capability list during driver initialization. In virtio_pci_read_cap() the device-supplied capability length byte cap_len (read from PCI config space via pcie_conf_read()) was only checked with assert(tmp.cap_len ==…
Brak sanitizacji w wtyczce Advance WP Query Search Filter umożliwia atak XSS na użytkowników z wysokimi uprawnieniami.
Brak sanitizacji w wtyczce Advance WP Query Search Filter umożliwia atak XSS na użytkowników z wysokimi uprawnieniami.
Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The authorization code callback did not carry a state parameter binding it to the authorization request that started the flow,…
Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Stored cross-site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF… | Stored cross-site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF file. |
Do wiadomości | 6,1 | 0,19 % | ||
| Reflected XSS w Shopware umożliwia atakującym wstrzyknięcie kodu przez niezabezpieczony parametr URL, co może prowadzić do kradzieży sesji. | Reflected XSS w Shopware umożliwia atakującym wstrzyknięcie kodu przez niezabezpieczony parametr URL, co może prowadzić do kradzieży sesji. |
Do wiadomości | 6,1 | 0,19 % | ||
| Reflected Cross-Site Scripting (XSS) in IDI Eikon's Governalia. | Reflected Cross-Site Scripting (XSS) in IDI Eikon's Governalia. The vulnerability allows an attacker to execute JavaScript code in the victim's browser when a malicious URL with the 'q' parameter in '/search' is sent to them. This vulnerability can be exploited to steal sensitive information such… |
Do wiadomości | 6,1 | 0,19 % | ||
| An issue was discovered in Logpoint before 7.7.0. | An issue was discovered in Logpoint before 7.7.0. Insufficient input validation and a lack of output escaping in multiple components leads to a cross-site scripting (XSS) vulnerability. |
Do wiadomości | 6,1 | 0,19 % | ||
| Cross-site scripting vulnerability exists in SNC-CX600W all versions. | Cross-site scripting vulnerability exists in SNC-CX600W all versions. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the product. |
Do wiadomości | 6,1 | 0,19 % | ||
| FreeScout is a self-hosted help desk and shared mailbox. | FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APP_CLOUDFLARE_IS_USED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an… |
Do wiadomości | 6,1 | 0,19 % | ||
| Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field. | Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field. |
Do wiadomości | 6,1 | 0,19 % | ||
| Przepełnienie bufora w GNU coreutils unexpand umożliwia zdalne wykonanie kodu. | Przepełnienie bufora w GNU coreutils unexpand umożliwia zdalne wykonanie kodu. |
Do wiadomości | 6,1 | 0,19 % | ||
| Luka XSS w sterowniku uwierzytelniania OpenNebula pozwala na wykonanie dowolnych skryptów webowych. | Luka XSS w sterowniku uwierzytelniania OpenNebula pozwala na wykonanie dowolnych skryptów webowych. |
Do wiadomości | 6,1 | 0,19 % | ||
| Wrażliwość XSS w OpenNebula umożliwia atakującym wykonanie dowolnych skryptów webowych. | Wrażliwość XSS w OpenNebula umożliwia atakującym wykonanie dowolnych skryptów webowych. |
Do wiadomości | 6,1 | 0,19 % | ||
| Wrażliwość XSS w OpenNebula umożliwia atakującym wykonywanie dowolnych skryptów webowych. | Wrażliwość XSS w OpenNebula umożliwia atakującym wykonywanie dowolnych skryptów webowych. |
Do wiadomości | 6,1 | 0,19 % | ||
| Wstrzyknięcie skryptów XSS w OpenNebula umożliwia wykonanie dowolnych skryptów webowych. | Wstrzyknięcie skryptów XSS w OpenNebula umożliwia wykonanie dowolnych skryptów webowych. |
Do wiadomości | 6,1 | 0,19 % | ||
| A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on… | A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to execute arbitrary code with root privileges. This vulnerability is due to insufficient boundary checks for specific data that is… |
Do wiadomości | 6,1 | 0,18 % | ||
| IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. | IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser |
Do wiadomości | 6,1 | 0,18 % | ||
| Emails sent by pretix can utilize placeholders that will be filled with customer data. | Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or Markdown formatting, this was rendered as HTML… |
Do wiadomości | 6,1 | 0,18 % | ||
| Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards… |
Do wiadomości | 6,1 | 0,18 % | ||
| When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new… | When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are… |
Do wiadomości | 6,1 | 0,18 % | ||
| A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly… | A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped. |
Do wiadomości | 6,1 | 0,18 % | ||
| Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process… | Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: High) |
Do wiadomości | 6,1 | 0,18 % | ||
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Seres Software syWEB allows… | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Seres Software syWEB allows Reflected XSS. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported. |
Do wiadomości | 6,1 | 0,18 % | ||
| The virtio PCI driver (drivers/virtio/virtio_pci.c) parses a device's PCI capability list during driver initialization. | The virtio PCI driver (drivers/virtio/virtio_pci.c) parses a device's PCI capability list during driver initialization. In virtio_pci_read_cap() the device-supplied capability length byte cap_len (read from PCI config space via pcie_conf_read()) was only checked with assert(tmp.cap_len ==… |
Do wiadomości | 6,1 | 0,18 % | ||
| Brak sanitizacji w wtyczce Advance WP Query Search Filter umożliwia atak XSS na użytkowników z wysokimi uprawnieniami. | Brak sanitizacji w wtyczce Advance WP Query Search Filter umożliwia atak XSS na użytkowników z wysokimi uprawnieniami. |
Do wiadomości | 6,1 | 0,18 % | ||
| Brak sanitizacji w wtyczce Advance WP Query Search Filter umożliwia atak XSS na użytkowników z wysokimi uprawnieniami. | Brak sanitizacji w wtyczce Advance WP Query Search Filter umożliwia atak XSS na użytkowników z wysokimi uprawnieniami. |
Do wiadomości | 6,1 | 0,18 % | ||
| Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component. | Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The authorization code callback did not carry a state parameter binding it to the authorization request that started the flow,… |
Do wiadomości | 6,1 | 0,18 % | ||
| Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system… | Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
Do wiadomości | 6,1 | 0,18 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.