Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/app/key to revoke AppKeys across…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by ignoring the can_only_join_via_invite setting. Attackers with the Raven User role can call the join_workspace method to become persistent members,…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler. This manipulation of the argument teamId causes improper privilege management. The…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 6.88 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /log/add, /log/update, /log/delete, and /log/deleteBatch to fabricate entries, rewrite user and IP…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps via the unpublish endpoint. Attackers can supply a target appId and appType from the exploration marketplace to delete other…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Clickjacking in EVP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter="false" and non-escaping default filters, executing script in…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments with an attacker-supplied Content-Type. Attackers can upload a file declared as text/html, which UploadShowAction serves inline, and share…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows any authenticated user to remove position members. Low-privileged attackers can send DELETE requests with arbitrary userIds and positionId values to delete…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete message templates. Low-privileged attackers can obtain template ids from the unguarded list endpoint and delete shipped…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated users to delete message records. Attackers can send DELETE requests with arbitrary id values to remove any sys_sms row, erasing records of sent…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragPromptsController that allows any authenticated user to delete AI prompt templates by calling DELETE /airag/prompts/delete. Low-privileged attackers can obtain template ids from the unguarded GET /airag/prompts/list…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any authenticated user to delete AI prompt templates. Low-privileged attackers can obtain prompt ids from the unguarded list endpoint and pass them to deleteBatch…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated user to purge AI prompt templates. Low-privileged attackers can send DELETE requests with prompt template ids to permanently remove…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled server_id and loads the server without restricting the lookup to servers owned by the authenticated account. On installations…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
CVSS
5,4
EPSS
0,21 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/app/key to revoke AppKeys across…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by ignoring the can_only_join_via_invite setting. Attackers with the Raven User role can call the join_workspace method to become persistent members,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler. This manipulation of the argument teamId causes improper privilege management. The…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 6.88 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /log/add, /log/update, /log/delete, and /log/deleteBatch to fabricate entries, rewrite user and IP…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps via the unpublish endpoint. Attackers can supply a target appId and appType from the exploration marketplace to delete other…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Clickjacking in EVP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter="false" and non-escaping default filters, executing script in…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments with an attacker-supplied Content-Type. Attackers can upload a file declared as text/html, which UploadShowAction serves inline, and share…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows any authenticated user to remove position members. Low-privileged attackers can send DELETE requests with arbitrary userIds and positionId values to delete…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete message templates. Low-privileged attackers can obtain template ids from the unguarded list endpoint and delete shipped…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated users to delete message records. Attackers can send DELETE requests with arbitrary id values to remove any sys_sms row, erasing records of sent…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragPromptsController that allows any authenticated user to delete AI prompt templates by calling DELETE /airag/prompts/delete. Low-privileged attackers can obtain template ids from the unguarded GET /airag/prompts/list…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any authenticated user to delete AI prompt templates. Low-privileged attackers can obtain prompt ids from the unguarded list endpoint and pass them to deleteBatch…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated user to purge AI prompt templates. Low-privileged attackers can send DELETE requests with prompt template ids to permanently remove…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled server_id and loads the server without restricting the lookup to servers owned by the authenticated account. On installations…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
5,4
0,21 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.