KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Niewystarczająca walidacja zakresu w OpenClaw pozwala niskoprzywilejowanym operatorom na rozszerzenie uprawnień.
Wstrzyknięcie skryptów w Adobe Commerce pozwala na przejęcie sesji użytkownika.
Niebezpieczne przekierowania w React Router mogą prowadzić do niezamierzonego wykonania kodu JavaScript.
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's…
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be served with attacker-controlled Content-Type (text/html), allowing execution of attacker-supplied HTML/JS in the application's origin and enabling session/token…
HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site…
The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could…
Błąd w systemie jail w FreeBSD uniemożliwia rootowi w więzieniu skuteczne śledzenie procesów.
Brak autoryzacji w JetBrains YouTrack umożliwia usunięcie dowolnych obiektów przez uwierzytelnionego użytkownika.
Błąd kontroli dostępu w Travelfic Toolkit umożliwia nieautoryzowany dostęp do danych.
Luka w kontroli dostępu w Ghost 5.x pozwala użytkownikom z rolą Autora na usuwanie postów innych użytkowników.
Brak kontroli uprawnień w wtyczce Solace Extra umożliwia niskoprawnym użytkownikom modyfikację ustawień.
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SAML to compromise…
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Connectors. Successful attacks of this…
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards…
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise JD…
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping…
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit…
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit…
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit…
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to…
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft…
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft…
An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: MARS (Multi-Application…
Luka w Oracle Hyperion Financial Management pozwala na nieautoryzowany dostęp do danych.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Niewystarczająca walidacja zakresu w OpenClaw pozwala niskoprzywilejowanym operatorom na rozszerzenie uprawnień. | Niewystarczająca walidacja zakresu w OpenClaw pozwala niskoprzywilejowanym operatorom na rozszerzenie uprawnień. |
Obserwuj | 8,1 | 0,38 % | ||
| Wstrzyknięcie skryptów w Adobe Commerce pozwala na przejęcie sesji użytkownika. | Wstrzyknięcie skryptów w Adobe Commerce pozwala na przejęcie sesji użytkownika. |
Obserwuj | 8,1 | 0,38 % | ||
| Niebezpieczne przekierowania w React Router mogą prowadzić do niezamierzonego wykonania kodu JavaScript. | Niebezpieczne przekierowania w React Router mogą prowadzić do niezamierzonego wykonania kodu JavaScript. |
Obserwuj | 8,0 | 0,88 % | ||
| bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote… | bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's… |
Obserwuj | 8,1 | 0,38 % | ||
| An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be served with attacker-controlled Content-Type (text/html), allowing execution of attacker-supplied HTML/JS in the application's origin and enabling session/token… |
Obserwuj | 8,1 | 0,38 % | ||
| HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. | HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site… |
Obserwuj | 8,1 | 0,38 % | ||
| The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its… | The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could… |
Obserwuj | 8,1 | 0,38 % | ||
| Błąd w systemie jail w FreeBSD uniemożliwia rootowi w więzieniu skuteczne śledzenie procesów. | Błąd w systemie jail w FreeBSD uniemożliwia rootowi w więzieniu skuteczne śledzenie procesów. |
Obserwuj | 8,1 | 0,38 % | ||
| Brak autoryzacji w JetBrains YouTrack umożliwia usunięcie dowolnych obiektów przez uwierzytelnionego użytkownika. | Brak autoryzacji w JetBrains YouTrack umożliwia usunięcie dowolnych obiektów przez uwierzytelnionego użytkownika. |
Obserwuj | 8,1 | 0,38 % | ||
| Błąd kontroli dostępu w Travelfic Toolkit umożliwia nieautoryzowany dostęp do danych. | Błąd kontroli dostępu w Travelfic Toolkit umożliwia nieautoryzowany dostęp do danych. |
Obserwuj | 8,1 | 0,38 % | ||
| Luka w kontroli dostępu w Ghost 5.x pozwala użytkownikom z rolą Autora na usuwanie postów innych użytkowników. | Luka w kontroli dostępu w Ghost 5.x pozwala użytkownikom z rolą Autora na usuwanie postów innych użytkowników. |
Obserwuj | 8,1 | 0,38 % | ||
| Brak kontroli uprawnień w wtyczce Solace Extra umożliwia niskoprawnym użytkownikom modyfikację ustawień. | Brak kontroli uprawnień w wtyczce Solace Extra umożliwia niskoprawnym użytkownikom modyfikację ustawień. |
Obserwuj | 8,1 | 0,38 % | ||
| Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SAML to compromise… |
Obserwuj | 8,1 | 0,38 % | ||
| Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Connectors. Successful attacks of this… |
Obserwuj | 8,1 | 0,38 % | ||
| Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards… |
Obserwuj | 8,1 | 0,38 % | ||
| Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise JD… |
Obserwuj | 8,1 | 0,38 % | ||
| Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). | Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping… |
Obserwuj | 8,1 | 0,38 % | ||
| Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit… |
Obserwuj | 8,1 | 0,38 % | ||
| Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit… |
Obserwuj | 8,1 | 0,38 % | ||
| Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit… |
Obserwuj | 8,1 | 0,38 % | ||
| Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality… | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to… |
Obserwuj | 8,1 | 0,38 % | ||
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft… |
Obserwuj | 8,1 | 0,38 % | ||
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft… |
Obserwuj | 8,1 | 0,38 % | ||
| An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). | An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: MARS (Multi-Application… |
Obserwuj | 8,1 | 0,38 % | ||
| Luka w Oracle Hyperion Financial Management pozwala na nieautoryzowany dostęp do danych. | Luka w Oracle Hyperion Financial Management pozwala na nieautoryzowany dostęp do danych. |
Obserwuj | 8,1 | 0,37 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.