Podatności

CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user…

CVSS 7,5 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user…

CVSS 7,5 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server, which could result in unauthorized access.

CVSS 7,5 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5.

CVSS 7,5 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

CVSS 7,5 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser

CVSS 7,5 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS).

CVSS 7,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki

Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network.

CVSS 7,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.

CVSS 7,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki

Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16.8.1.

CVSS 7,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2.

CVSS 7,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a type confusion flaw.

CVSS 7,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery (denial of service). The server set its socket timeouts in the form Windows takes, which Linux refuses,…

CVSS 7,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor…

CVSS 7,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled.

CVSS 7,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.

CVSS 7,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In deployments that use SAML authentication, an unauthenticated remote attacker could cause the affected server to accept an assertion that…

CVSS 7,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.

CVSS 7,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled.

CVSS 7,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Unauthenticated Broken Access Control in DK <= 3.2.1 versions.

CVSS 7,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

CVSS 7,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.

CVSS 7,5 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid users, leading to a Denial of Service (DoS).

CVSS 7,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.

CVSS 7,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108.

CVSS 7,5 · EPSS 0,2 % · rekomendacja wg zapisanej polityki