KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2.
A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.
A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption
FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes…
The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In deployments that use SAML authentication, an unauthenticated remote attacker could cause the affected server to accept an assertion that…
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled.
Unauthenticated Broken Access Control in DK <= 3.2.1 versions.
Unauthenticated Broken Access Control in Grand News <= 3.4 versions.
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently…
Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.
In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits. The size limit was applied only to each physical line, not to a header value built…
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg_der_to_tlv() and mg_der_next(), a peer-controlled length can…
Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. Successful exploitation may allow a low-privileged authenticated user to upload…
Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108.
Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating…
The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a struct k_work embedded in the channel object (le_chan->rx_work, handler l2cap_rx_process()) whenever the channel uses a dynamic PSM (0x0080-0x00FF). Channel teardown in…
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through an affected connection.
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or network attacker able to alter both responses can supply a…
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could…
Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) did not ensure that the XML passed to the application was covered by the…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator:… | Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2. |
Obserwuj | 7,5 | 0,27 % | ||
| A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS. | A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS. |
Obserwuj | 7,5 | 0,27 % | ||
| A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption | A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption |
Obserwuj | 7,5 | 0,26 % | ||
| FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing… | FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes… |
Obserwuj | 7,5 | 0,26 % | ||
| The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages… | The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide. |
Obserwuj | 7,5 | 0,25 % | ||
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in… | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In deployments that use SAML authentication, an unauthenticated remote attacker could cause the affected server to accept an assertion that… |
Obserwuj | 7,5 | 0,25 % | ||
| Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce… | Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3. |
Obserwuj | 7,5 | 0,25 % | ||
| Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions… | Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled. |
Obserwuj | 7,5 | 0,25 % | ||
| Unauthenticated Broken Access Control in DK <= 3.2.1 versions. | Unauthenticated Broken Access Control in DK <= 3.2.1 versions. |
Obserwuj | 7,5 | 0,25 % | ||
| Unauthenticated Broken Access Control in Grand News <= 3.4 versions. | Unauthenticated Broken Access Control in Grand News <= 3.4 versions. |
Obserwuj | 7,5 | 0,25 % | ||
| Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. | Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently… |
Obserwuj | 7,5 | 0,25 % | ||
| Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions. | Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions. |
Obserwuj | 7,5 | 0,24 % | ||
| In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size… | In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits. The size limit was applied only to each physical line, not to a header value built… |
Obserwuj | 7,5 | 0,24 % | ||
| Mongoose is an embedded web server and network library. | Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg_der_to_tlv() and mg_der_next(), a peer-controlled length can… |
Obserwuj | 7,5 | 0,23 % | ||
| Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing… | Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. Successful exploitation may allow a low-privileged authenticated user to upload… |
Obserwuj | 7,5 | 0,23 % | ||
| Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access… | Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2. |
Obserwuj | 7,5 | 0,22 % | ||
| Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). | Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. |
Obserwuj | 7,5 | 0,21 % | ||
| Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security… | Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108. |
Obserwuj | 7,5 | 0,2 % | ||
| Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security… | Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10. |
Obserwuj | 7,5 | 0,2 % | ||
| OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to… | OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating… |
Obserwuj | 7,5 | 0,19 % | ||
| The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a struct k_work… | The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a struct k_work embedded in the channel object (le_chan->rx_work, handler l2cap_rx_process()) whenever the channel uses a dynamic PSM (0x0080-0x00FF). Channel teardown in… |
Obserwuj | 7,5 | 0,18 % | ||
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3… | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through an affected connection. |
Obserwuj | 7,5 | 0,18 % | ||
| Nginx UI is a web user interface for the Nginx web server. | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or network attacker able to alter both responses can supply a… |
Obserwuj | 7,5 | 0,17 % | ||
| By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. | By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could… |
Obserwuj | 7,5 | 0,17 % | ||
| Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. | Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) did not ensure that the XML passed to the application was covered by the… |
Obserwuj | 7,5 | 0,17 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.