Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify third-party application configurations. Low-privileged attackers can replace client id, client secret, agent id and corp id of DingTalk, WeCom or…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST /sys/tenant/changeOwenUserTenant. Low-privileged attackers can supply userId and tenantId parameters to reassign any tenant's owner to a member, including…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a share or delegation grant.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Faktur Pro for WooCommerce: from n/a through 3.2.2.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Deposits and Partial Payments for WooCommerce: from…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows an authenticated mailbox user to cause a denial of service (service crash), and possibly other unspecified impact.…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.6.2.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Improper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Advancity ALMS Cloud: through 2026-10-08. NOTE: The vendor was contacted early about this disclosure but did not…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a through 1.2.3.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusive) allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn,…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Incorrect authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attackers…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
PraisonAI is a multi-agent teams system. In `praisonai-platform` prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
CVSS
6,5
EPSS
0,18 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify third-party application configurations. Low-privileged attackers can replace client id, client secret, agent id and corp id of DingTalk, WeCom or…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST /sys/tenant/changeOwenUserTenant. Low-privileged attackers can supply userId and tenantId parameters to reassign any tenant's owner to a member, including…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a share or delegation grant.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Faktur Pro for WooCommerce: from n/a through 3.2.2.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Deposits and Partial Payments for WooCommerce: from…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows an authenticated mailbox user to cause a denial of service (service crash), and possibly other unspecified impact.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.6.2.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Improper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Advancity ALMS Cloud: through 2026-10-08. NOTE: The vendor was contacted early about this disclosure but did not…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a through 1.2.3.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusive) allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Incorrect authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attackers…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
PraisonAI is a multi-agent teams system. In `praisonai-platform` prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
6,5
0,18 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.