KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF. The content is processed by…
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3.
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key,…
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the…
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject…
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured.
Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions.
Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions.
Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions.
Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.
Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.
Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.
Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.
Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. | Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF. The content is processed by… |
Obserwuj | 7,1 | 0,21 % | ||
| Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to… | Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in… |
Obserwuj | 7,1 | 0,21 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4. |
Obserwuj | 7,1 | 0,2 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3. |
Obserwuj | 7,1 | 0,2 % | ||
| CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read… | CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key,… |
Obserwuj | 7,1 | 0,2 % | ||
| Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. | Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing… |
Obserwuj | 7,1 | 0,19 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12. |
Obserwuj | 7,1 | 0,19 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0. |
Obserwuj | 7,1 | 0,19 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27. |
Obserwuj | 7,1 | 0,19 % | ||
| Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML… | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the… |
Obserwuj | 7,1 | 0,19 % | ||
| Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by… | Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject… |
Obserwuj | 7,1 | 0,19 % | ||
| A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an… | A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured. |
Obserwuj | 7,1 | 0,19 % | ||
| Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions. | Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions. |
Obserwuj | 7,1 | 0,18 % | ||
| Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions. | Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions. |
Obserwuj | 7,1 | 0,18 % | ||
| Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions. | Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions. |
Obserwuj | 7,1 | 0,18 % | ||
| Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions. | Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions. |
Obserwuj | 7,1 | 0,18 % | ||
| Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions. | Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions. |
Obserwuj | 7,1 | 0,18 % | ||
| Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions. | Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions. |
Obserwuj | 7,1 | 0,18 % | ||
| Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions. | Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions. |
Obserwuj | 7,1 | 0,18 % | ||
| Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions. | Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions. |
Obserwuj | 7,1 | 0,18 % | ||
| Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions. | Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions. |
Obserwuj | 7,1 | 0,18 % | ||
| Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions. | Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions. |
Obserwuj | 7,1 | 0,18 % | ||
| Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions. | Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions. |
Obserwuj | 7,1 | 0,18 % | ||
| Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions. | Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions. |
Obserwuj | 7,1 | 0,18 % | ||
| Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions. | Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions. |
Obserwuj | 7,1 | 0,18 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.