Podatności

abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call…

CVSS 5,4 · rekomendacja wg zapisanej polityki

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call dt_verify_external_connection with a chosen endpointId and url to send stored connection…

CVSS 5,4 · rekomendacja wg zapisanej polityki

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign company_id. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or…

CVSS 5,4 · rekomendacja wg zapisanej polityki

B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors' drafts, probe draft…

CVSS 5,4 · rekomendacja wg zapisanej polityki

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders…

CVSS 5,4 · rekomendacja wg zapisanej polityki

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE…

CVSS 5,4 · rekomendacja wg zapisanej polityki

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an authenticated member of a shared Space…

CVSS 5,4 · rekomendacja wg zapisanej polityki

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a…

CVSS 5,4 · rekomendacja wg zapisanej polityki

An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input

CVSS 5,4 · rekomendacja wg zapisanej polityki

Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4.

CVSS 5,4 · rekomendacja wg zapisanej polityki

The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to permanently delete that backup and the plugin's generated WebP derivatives,…

CVSS 5,4 · rekomendacja wg zapisanej polityki

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract…

CVSS 5,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki

rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid without uuid verification, then log in…

CVSS 5,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validate_url checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata…

CVSS 5,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService…

CVSS 5,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki

APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/{nodeId}/description, which skips space membership and node permission…

CVSS 5,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, which lacks participant checks, to obtain full message history…

CVSS 5,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to manage other tenants' ports because the target application's organization is never verified. Attackers supplying a known portId or…

CVSS 5,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import to…

CVSS 5,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler at…

CVSS 5,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and…

CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocations and reconfigure…

CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. SVG images can contain clickable links or executable scripting. By uploading a crafted SVG, it is possible to execute scripting in…

CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI servers[0].url in a user-defined action. Attackers holding a project API key or console admin login…

CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TC_DYNAMIC_SECURITY constant being hardcoded to a publicly known value. This makes it possible for…

CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki