Podatności

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for…

CVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/send. Unauthenticated attackers reaching port 18790, which binds all interfaces by default, can inject blind prompts into…

CVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

Missing authorization in FedCM in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

Incorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

Information leak in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via crafted network traffic. (Chromium security severity: Medium)

CVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's `SlotEntry` by supplying the victim's `slot_entry` ID in a `POST /api/v2/workoutlog/` request. The `slot_entry` foreign key is not…

CVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username,…

CVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can point that remote at a server they…

CVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

Protection mechanism failure in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

IBM Guardium Data Protection 12.2.2 is affected by a sensitive information exposure vulnerability. During SECRET and API_KEY rotation processing, sensitive credential material is logged at INFO level by the edge-controller/edge-manager components. An authenticated attacker with access to the…

CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow.

CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions.

CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other users, including search query text, job…

CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Missing authorization in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low)

CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.

CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)

CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Incorrect authorization in USB in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)

CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthenticated attackers can send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and…

CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Incorrect authorization in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Incorrect authorization in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Incorrect authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.

CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki