KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pay for Payment for WooCommerce: from n/a through 3.0.1.
The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's…
The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state.
The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives…
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message Containing Sensitive Information vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and…
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may be vulnerable to audit log forgery.
Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll,…
The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing unauthenticated users to retrieve another guest's quote, including the buyer's name, email address and requested line items, by supplying an enumerable…
The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated…
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.
Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.
The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled.
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call these endpoints to trigger transactional…
Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated attackers can send requests to these endpoints to modify documents and data beyond what their assigned role…
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings.
Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to the proprietary BLE command characteristic. Attackers within Bluetooth range can craft commands protected only by a CRC-16/ARC…
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite data_rule_ids, clearing row-level…
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and dataRuleIds values to overwrite…
CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId values for contracts, invoices, quotations…
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows Leveraging Race Conditions.This issue affects Tutor LMS: from n/a through 4.1.1.
The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting…
The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark…
The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed.
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting… | Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pay for Payment for WooCommerce: from n/a through 3.0.1. |
Do wiadomości | 5,3 | 0,18 % | ||
| The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its… | The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's… |
Do wiadomości | 5,3 | 0,18 % | ||
| The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing… | The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state. |
Do wiadomości | 5,3 | 0,18 % | ||
| The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress… | The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives… |
Do wiadomości | 5,3 | 0,18 % | ||
| Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message Containing… | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message Containing Sensitive Information vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and… |
Do wiadomości | 5,3 | 0,18 % | ||
| IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may be vulnerable to audit log forgery. | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may be vulnerable to audit log forgery. |
Do wiadomości | 5,3 | 0,18 % | ||
| Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by… | Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll,… |
Do wiadomości | 5,3 | 0,18 % | ||
| The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing… | The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing unauthenticated users to retrieve another guest's quote, including the buyer's name, email address and requested line items, by supplying an enumerable… |
Do wiadomości | 5,3 | 0,18 % | ||
| The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only… | The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated… |
Do wiadomości | 5,3 | 0,18 % | ||
| Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access… | Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25. |
Do wiadomości | 5,3 | 0,18 % | ||
| Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security… | Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28. |
Do wiadomości | 5,3 | 0,18 % | ||
| Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting… | Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0. |
Do wiadomości | 5,3 | 0,18 % | ||
| The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration… | The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled. |
Do wiadomości | 5,3 | 0,18 % | ||
| Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to… | Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call these endpoints to trigger transactional… |
Do wiadomości | 5,3 | 0,17 % | ||
| Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to… | Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated attackers can send requests to these endpoints to modify documents and data beyond what their assigned role… |
Do wiadomości | 5,3 | 0,17 % | ||
| The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes… | The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings. |
Do wiadomości | 5,3 | 0,17 % | ||
| Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to… | Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to the proprietary BLE command characteristic. Attackers within Bluetooth range can craft commands protected only by a CRC-16/ARC… |
Do wiadomości | 5,3 | 0,17 % | ||
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows… | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite data_rule_ids, clearing row-level… |
Do wiadomości | 5,3 | 0,17 % | ||
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets… | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and dataRuleIds values to overwrite… |
Do wiadomości | 5,3 | 0,17 % | ||
| CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to… | CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId values for contracts, invoices, quotations… |
Do wiadomości | 5,3 | 0,17 % | ||
| Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor… | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows Leveraging Race Conditions.This issue affects Tutor LMS: from n/a through 4.1.1. |
Do wiadomości | 5,3 | 0,17 % | ||
| The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles… | The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting… |
Do wiadomości | 5,3 | 0,17 % | ||
| The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming,… | The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark… |
Do wiadomości | 5,3 | 0,17 % | ||
| The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification… | The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed. |
Do wiadomości | 5,3 | 0,17 % | ||
| The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select… | The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that… |
Do wiadomości | 5,3 | 0,17 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.