Podatności

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one…

CVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify WordPress…

CVSS 9,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.

CVSS 9,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.

CVSS 9,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit_form function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form…

CVSS 9,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)

CVSS 9,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has…

CVSS 9,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. A remote attacker could send a specially crafted TDS LOGIN7 packet containing invalid offset or length values, potentially causing information disclosure or denial of…

CVSS 9,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database…

CVSS 9,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation.

CVSS 9,1 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use the last. A contributor could open a pull request whose…

CVSS 9,1 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer…

CVSS 9,1 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filter('dokan_register_nonce_check',…

CVSS 9,1 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)

CVSS 9,1 · EPSS 0,28 % · rekomendacja wg zapisanej polityki

When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another…

CVSS 9,1 · EPSS 0,28 % · rekomendacja wg zapisanej polityki

Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta allows Password Recovery Exploitation. This issue affects MyRezzta: from 2.06.03 before 2.07.01.

CVSS 9,1 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions.

CVSS 9,1 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases…

CVSS 9,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.

CVSS 9,1 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the…

CVSS 9,1 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certificate public key and client nonce but not to the active TLS session before…

CVSS 9,1 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who…

CVSS 9,1 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS…

CVSS 9,1 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime's RA-TLS challenge certificate path placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS…

CVSS 9,1 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence…

CVSS 9,1 · rekomendacja wg zapisanej polityki