Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit on entity expansion. A document with a DOCTYPE that declares internal entities can expand to a very large value and exhaust the server…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role,…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image configuration in a Kubernetes operator template.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops filtering those fields when per-user ACL application is…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/{id}/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can directly fetch a Note through the portal Note API and read an internal stream note when the note identifier is known. Stream list responses correctly hide…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a crafted PUT request to the member roles…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond what their assigned…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
CVSS
6,5
EPSS
0,22 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit on entity expansion. A document with a DOCTYPE that declares internal entities can expand to a very large value and exhaust the server…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image configuration in a Kubernetes operator template.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops filtering those fields when per-user ACL application is…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/{id}/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can directly fetch a Note through the portal Note API and read an internal stream note when the note identifier is known. Stream list responses correctly hide…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a crafted PUT request to the member roles…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond what their assigned…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
6,5
0,22 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.