Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130).
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects.
The affected endpoints check permissions against the supplied projectCode but fail to…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacks Shiro permission or role annotations. Any authenticated low-privileged user can supply datasource codes in the dbSourceCode parameter to…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
A vulnerability in the export policies functionality of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to access sensitive files on an affected device. To exploit this vulnerability, the attacker must have valid administrative…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is commented out. Attackers can obtain record ids from the unguarded /airag/app/queryById endpoint and retrieve MCP…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set. An attacker with both a valid share link and…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web_fetch_tool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_month' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Authorization vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Unauthorized access.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of email content and headers to an arbitrary address.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Improper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an authenticated user to cause a denial of service using a specially crafted HTTP query due to improper allocation of system resources
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Uninitialized resource in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
CVSS
6,5
EPSS
0,27 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130).
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects.
The affected endpoints check permissions against the supplied projectCode but fail to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacks Shiro permission or role annotations. Any authenticated low-privileged user can supply datasource codes in the dbSourceCode parameter to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
A vulnerability in the export policies functionality of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to access sensitive files on an affected device. To exploit this vulnerability, the attacker must have valid administrative…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is commented out. Attackers can obtain record ids from the unguarded /airag/app/queryById endpoint and retrieve MCP…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set. An attacker with both a valid share link and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web_fetch_tool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_month' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Authorization vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Unauthorized access.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of email content and headers to an arbitrary address.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Improper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an authenticated user to cause a denial of service using a specially crafted HTTP query due to improper allocation of system resources
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Uninitialized resource in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
6,5
0,27 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.