KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Błąd niezainicjowanej wartości w jądrze Linux umożliwia nieautoryzowany dostęp do pamięci.
Wstrzyknięcie SQL w ServerZilla umożliwia nieautoryzowanym atakującym manipulację zapytaniami.
Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.
Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5.
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3.
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt…
Cross Site Request Forgery w nopCommerce umożliwia nieautoryzowane wykonanie zadań.
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default renders a schema-controlled enum field default as an enum member…
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.
The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role.
Wstrzyknięcie SQL w EdTv 2 umożliwia nieautoryzowanym atakującym wykonanie dowolnych zapytań.
EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
Wykonanie zdalnego kodu w Craft CMS umożliwia atakującemu z dostępem do panelu.
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't filter by BSS type when removing stale entries When an assoc AP switches to a channel that already has a BSS entry, cfg80211_update_assoc_bss_entry() removes that entry before rehashing the real one, since…
Błąd w WebKitGTK umożliwia przetwarzanie złośliwych treści i prowadzi do uszkodzenia pamięci.
Nieprawidłowa autoryzacja w Blog Site 1.0 umożliwia zdalne przejęcie dostępu.
Wstrzyknięcie SQL w CodeAstro Gym Management System umożliwia zdalne ataki.
Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally.
Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values…
The Postem Ipsum plugin for WordPress is vulnerable to unauthorized modification of data to Privilege Escalation due to a missing capability check on the postem_ipsum_generate_users() function in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with…
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Podatność w facil.io umożliwia zdalnym atakującym awarię serwera przez złośliwy nagłówek.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Błąd niezainicjowanej wartości w jądrze Linux umożliwia nieautoryzowany dostęp do pamięci. | Błąd niezainicjowanej wartości w jądrze Linux umożliwia nieautoryzowany dostęp do pamięci. |
Obserwuj | 8,8 | 0,29 % | ||
| Wstrzyknięcie SQL w ServerZilla umożliwia nieautoryzowanym atakującym manipulację zapytaniami. | Wstrzyknięcie SQL w ServerZilla umożliwia nieautoryzowanym atakującym manipulację zapytaniami. |
Obserwuj | 8,8 | 0,29 % | ||
| Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox… | Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Obserwuj | 8,8 | 0,29 % | ||
| Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by… | Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62. |
Obserwuj | 8,8 | 0,29 % | ||
| Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This… | Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5. |
Obserwuj | 8,8 | 0,29 % | ||
| Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio:… | Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3. |
Obserwuj | 8,8 | 0,29 % | ||
| Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue… | Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7. |
Obserwuj | 8,8 | 0,29 % | ||
| Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates)… | Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19. |
Obserwuj | 8,8 | 0,29 % | ||
| In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length… | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt… |
Obserwuj | 8,8 | 0,29 % | ||
| Cross Site Request Forgery w nopCommerce umożliwia nieautoryzowane wykonanie zadań. | Cross Site Request Forgery w nopCommerce umożliwia nieautoryzowane wykonanie zadań. |
Obserwuj | 8,8 | 0,29 % | ||
| dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from… | dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default renders a schema-controlled enum field default as an enum member… |
Obserwuj | 8,8 | 0,29 % | ||
| Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects… | Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5. |
Obserwuj | 8,8 | 0,29 % | ||
| The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one… | The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role. |
Obserwuj | 8,8 | 0,29 % | ||
| Wstrzyknięcie SQL w EdTv 2 umożliwia nieautoryzowanym atakującym wykonanie dowolnych zapytań. | Wstrzyknięcie SQL w EdTv 2 umożliwia nieautoryzowanym atakującym wykonanie dowolnych zapytań. |
Obserwuj | 8,8 | 0,29 % | ||
| EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. | EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server. |
Obserwuj | 8,7 | 0,79 % | ||
| Wykonanie zdalnego kodu w Craft CMS umożliwia atakującemu z dostępem do panelu. | Wykonanie zdalnego kodu w Craft CMS umożliwia atakującemu z dostępem do panelu. |
Obserwuj | 8,7 | 0,79 % | ||
| In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't filter by BSS type when removing stale… | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't filter by BSS type when removing stale entries When an assoc AP switches to a channel that already has a BSS entry, cfg80211_update_assoc_bss_entry() removes that entry before rehashing the real one, since… |
Obserwuj | 8,8 | 0,29 % | ||
| Błąd w WebKitGTK umożliwia przetwarzanie złośliwych treści i prowadzi do uszkodzenia pamięci. | Błąd w WebKitGTK umożliwia przetwarzanie złośliwych treści i prowadzi do uszkodzenia pamięci. |
Obserwuj | 8,8 | 0,29 % | ||
| Nieprawidłowa autoryzacja w Blog Site 1.0 umożliwia zdalne przejęcie dostępu. | Nieprawidłowa autoryzacja w Blog Site 1.0 umożliwia zdalne przejęcie dostępu. |
Obserwuj | 8,8 | 0,29 % | ||
| Wstrzyknięcie SQL w CodeAstro Gym Management System umożliwia zdalne ataki. | Wstrzyknięcie SQL w CodeAstro Gym Management System umożliwia zdalne ataki. |
Obserwuj | 8,8 | 0,29 % | ||
| Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally. | Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally. |
Obserwuj | 8,8 | 0,28 % | ||
| Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might… | Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values… |
Obserwuj | 8,8 | 0,28 % | ||
| The Postem Ipsum plugin for WordPress is vulnerable to unauthorized modification of data to Privilege Escalation due to a missing… | The Postem Ipsum plugin for WordPress is vulnerable to unauthorized modification of data to Privilege Escalation due to a missing capability check on the postem_ipsum_generate_users() function in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with… |
Obserwuj | 8,8 | 0,28 % | ||
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized… | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
Obserwuj | 8,7 | 0,78 % | ||
| Podatność w facil.io umożliwia zdalnym atakującym awarię serwera przez złośliwy nagłówek. | Podatność w facil.io umożliwia zdalnym atakującym awarię serwera przez złośliwy nagłówek. |
Obserwuj | 8,7 | 0,78 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.