Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
In the Linux kernel, the following vulnerability has been resolved:
ntfs: avoid stale runlist element dereference in MFT writeback
ntfs_write_mft_block() maps each $MFT record through the $MFT data
runlist. For sub-folio clusters it looks up a struct runlist_element under
ni->runlist.lock, drops…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
Fix several related bounds checking and pointer lifecycle issues in
receive_encrypted_standard()'s handling of compound encrypted frames:
- Clear…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.7.1. This is due to missing authorization checks and nonce verification in the `get_user()` function of the `Module_Password_Hint` class, which unconditionally calls…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own role to `owner`. The issue is caused by privileged…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be executed…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
ntfs: avoid stale runlist element dereference in MFT writeback
ntfs_write_mft_block() maps each $MFT record through the $MFT data
runlist. For sub-folio clusters it looks up a struct runlist_element under
ni->runlist.lock, drops…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
Fix several related bounds checking and pointer lifecycle issues in
receive_encrypted_standard()'s handling of compound encrypted frames:
- Clear…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.7.1. This is due to missing authorization checks and nonce verification in the `get_user()` function of the `Module_Password_Hint` class, which unconditionally calls…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own role to `owner`. The issue is caused by privileged…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be executed…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,51 % · rekomendacja wg zapisanej polityki