Podatności

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from…

CVSS 7,5 · EPSS 0,53 % · rekomendacja wg zapisanej polityki

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service

CVSS 7,5 · EPSS 0,52 % · rekomendacja wg zapisanej polityki

mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause a denial of service

CVSS 7,5 · EPSS 0,52 % · rekomendacja wg zapisanej polityki

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a…

CVSS 7,5 · EPSS 0,52 % · rekomendacja wg zapisanej polityki

Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.

CVSS 7,5 · EPSS 0,52 % · rekomendacja wg zapisanej polityki

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue…

CVSS 7,5 · EPSS 0,51 % · rekomendacja wg zapisanej polityki

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue…

CVSS 7,5 · EPSS 0,51 % · rekomendacja wg zapisanej polityki

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue…

CVSS 7,5 · EPSS 0,51 % · rekomendacja wg zapisanej polityki

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and to be dispatchable through…

CVSS 7,5 · EPSS 0,51 % · rekomendacja wg zapisanej polityki

ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CVSS 7,5 · EPSS 0,51 % · rekomendacja wg zapisanej polityki

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 7,5 · EPSS 0,51 % · rekomendacja wg zapisanej polityki

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 7,5 · EPSS 0,51 % · rekomendacja wg zapisanej polityki

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The issue occurs in CreateCommonPacketFormatStructure() when it parses recognized optional socket address information items of type…

CVSS 7,5 · EPSS 0,51 % · rekomendacja wg zapisanej polityki

EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL…

CVSS 7,6 · rekomendacja wg zapisanej polityki

A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash.

CVSS 7,6 · rekomendacja wg zapisanej polityki

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves…

CVSS 7,5 · EPSS 0,5 % · rekomendacja wg zapisanej polityki

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user…

CVSS 7,5 · EPSS 0,5 % · rekomendacja wg zapisanej polityki

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user…

CVSS 7,5 · EPSS 0,5 % · rekomendacja wg zapisanej polityki

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataIn_handler is vulnerable because the handler treats the minimum packet-length condition as FW_ASSERT rather than…

CVSS 7,5 · EPSS 0,49 % · rekomendacja wg zapisanej polityki

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser

CVSS 7,5 · EPSS 0,49 % · rekomendacja wg zapisanej polityki

ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.

CVSS 7,5 · EPSS 0,49 % · rekomendacja wg zapisanej polityki

Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the…

CVSS 7,5 · EPSS 0,48 % · rekomendacja wg zapisanej polityki

Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk…

CVSS 7,5 · EPSS 0,48 % · rekomendacja wg zapisanej polityki

EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List service. This allows a remote attacker to cause a denial of service

CVSS 7,5 · EPSS 0,48 % · rekomendacja wg zapisanej polityki

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `cart[id]` parameters on the `steps__reload_booking_form_summary_panel` and…

CVSS 7,5 · EPSS 0,48 % · rekomendacja wg zapisanej polityki