Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The WP CarDealer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.16. This is due to the 'WP_CarDealer_User::process_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The WP CarDealer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.16. This is due to the 'WP_CarDealer_User::process_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,34 % · rekomendacja wg zapisanej polityki