Podatności

An improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Manager, where application functionality may be invoked by untrusted sources. Successful exploitation could allow an unauthenticated remote attacker, with user interaction, to…

CVSS 8,8 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVSS 8,8 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1.

CVSS 8,8 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary…

CVSS 8,8 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVSS 8,8 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.

CVSS 8,8 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.

CVSS 8,8 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects OctoCloud: from 1.12.06 before 1.12.07.

CVSS 8,8 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Information leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

Incorrect authorization in Transactions Platform in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

Incorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

Incorrect authorization in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in…

CVSS 8,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role.

CVSS 8,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 8,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store…

CVSS 8,8 · EPSS 0,2 % · rekomendacja wg zapisanej polityki

Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding…

CVSS 8,7 · EPSS 0,69 % · rekomendacja wg zapisanej polityki

The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing unauthenticated users to inject arbitrary web scripts that will execute in the…

CVSS 8,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki

The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site…

CVSS 8,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or…

CVSS 8,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The…

CVSS 8,8 · EPSS 0,18 % · rekomendacja wg zapisanej polityki

ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does…

CVSS 8,7 · EPSS 0,68 % · rekomendacja wg zapisanej polityki