Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,53 % · rekomendacja wg zapisanej polityki
IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request to write arbitrary files on the system.
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,53 % · rekomendacja wg zapisanej polityki
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,52 % · rekomendacja wg zapisanej polityki
The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handle_request() function routing the mbfs_delete action without any capability or…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,52 % · rekomendacja wg zapisanej polityki
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Opis źródłowy NVD · ENCVSS 9,0 · EPSS 1,02 % · rekomendacja wg zapisanej polityki
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.
This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,52 % · rekomendacja wg zapisanej polityki
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application.
This vulnerability is due to improper checks…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,52 % · rekomendacja wg zapisanej polityki
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,52 % · rekomendacja wg zapisanej polityki
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 2,51 % · rekomendacja wg zapisanej polityki
CVSS
8,7
EPSS
2,51 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,53 % · rekomendacja wg zapisanej polityki
IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request to write arbitrary files on the system.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,53 % · rekomendacja wg zapisanej polityki
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,52 % · rekomendacja wg zapisanej polityki
The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handle_request() function routing the mbfs_delete action without any capability or…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,52 % · rekomendacja wg zapisanej polityki
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,0 · EPSS 1,02 % · rekomendacja wg zapisanej polityki
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.
This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,52 % · rekomendacja wg zapisanej polityki
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application.
This vulnerability is due to improper checks…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,52 % · rekomendacja wg zapisanej polityki
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,52 % · rekomendacja wg zapisanej polityki
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 2,51 % · rekomendacja wg zapisanej polityki
8,7
2,51 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.