Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
SQL Injection vulnerability in opentext Flipper allows SQL Injection.
The vulnerability could allow a low privilege user to interact with the database in unintended ways and extract data by interacting with the HQL processor.
This issue affects Flipper: 3.1.2.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser,…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
SQL Injection vulnerability in opentext Flipper allows SQL Injection.
The vulnerability could allow a low privilege user to interact with the database in unintended ways and extract data by interacting with the HQL processor.
This issue affects Flipper: 3.1.2.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,36 % · rekomendacja wg zapisanej polityki