Podatności

Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request…

CVSS 5,9 · EPSS 0,14 % · rekomendacja wg zapisanej polityki

A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.

CVSS 5,9 · EPSS 0,07 % · rekomendacja wg zapisanej polityki

Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflake ID, to obtain the…

CVSS 5,9 · rekomendacja wg zapisanej polityki

SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks…

CVSS 5,9 · rekomendacja wg zapisanej polityki

Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.

CVSS 5,9 · rekomendacja wg zapisanej polityki

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected:…

CVSS 5,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService,…

CVSS 5,8 · rekomendacja wg zapisanej polityki

Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role…

CVSS 5,6 · rekomendacja wg zapisanej polityki

A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki_type can lead to server-side request forgery. It is possible to launch the…

CVSS 5,5 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and…

CVSS 5,5 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an…

CVSS 5,5 · rekomendacja wg zapisanej polityki

Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap…

CVSS 5,5 · rekomendacja wg zapisanej polityki

Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus

CVSS 5,5 · rekomendacja wg zapisanej polityki

The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' parameter in all versions up to, and including, 3.2.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…

CVSS 5,4 · EPSS 0,36 % · rekomendacja wg zapisanej polityki

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removing WordPress's wp_filter_post_kses filter from content_save_pre immediately before calling wp_insert_post() with RSS feed content,…

CVSS 5,4 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the get_user_profile_structure() function assembling the front-end profile buffer — which includes raw comment excerpts inlined by…

CVSS 5,4 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running…

CVSS 5,4 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel,…

CVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.

CVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads…

CVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software…

CVSS 5,4 · EPSS 0,18 % · rekomendacja wg zapisanej polityki

Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on…

CVSS 5,4 · rekomendacja wg zapisanej polityki

WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET…

CVSS 5,4 · rekomendacja wg zapisanej polityki

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a…

CVSS 5,4 · rekomendacja wg zapisanej polityki

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress, PATCH, retry and approve-extraction…

CVSS 5,4 · rekomendacja wg zapisanej polityki