Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requests to the v1 or v2 projects shares…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing __proto__, constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Symantec Endpoint Detection and Response (SEDR) Console, prior to 4.13, may be susceptible to a Cross-Site Scripting (XSS) vulnerability, which is a type of issue whereby an attacker may attempt to inject malicious script that executes in the context of another user’s session, potentially…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them,…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
The Hub collection module documentation renderer in the unified Ansible Automation Platform UI (built from upstream ansible-ui, frontend/hub) renders a documentation URL part (formatPartURL in DocumentationParsers.tsx) as a link without restricting the URL protocol/scheme. A collection whose…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor. JobCodeController.save() stores the user-supplied glueSource parameter without output encoding, and the FreeMarker template job.code.ftl renders the stored value unescaped.
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog). An authenticated user who holds permission on a target executor job group can inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe markup without properly sanitizing URL values or encoding the Window iframe title. An attacker…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and parses the resulting text as HTML. An attacker who can modify a validation message can cause HTML that was correctly escaped in the…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can supply HTML containing event handlers that execute…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing event…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credentials…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4.
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In `route_mapper/account.lua`, `get_user_privilege` returns the complete…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,65 % · rekomendacja wg zapisanej polityki
CVSS
5,3
EPSS
0,65 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requests to the v1 or v2 projects shares…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing __proto__, constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Symantec Endpoint Detection and Response (SEDR) Console, prior to 4.13, may be susceptible to a Cross-Site Scripting (XSS) vulnerability, which is a type of issue whereby an attacker may attempt to inject malicious script that executes in the context of another user’s session, potentially…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
The Hub collection module documentation renderer in the unified Ansible Automation Platform UI (built from upstream ansible-ui, frontend/hub) renders a documentation URL part (formatPartURL in DocumentationParsers.tsx) as a link without restricting the URL protocol/scheme. A collection whose…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor. JobCodeController.save() stores the user-supplied glueSource parameter without output encoding, and the FreeMarker template job.code.ftl renders the stored value unescaped.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog). An authenticated user who holds permission on a target executor job group can inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe markup without properly sanitizing URL values or encoding the Window iframe title. An attacker…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and parses the resulting text as HTML. An attacker who can modify a validation message can cause HTML that was correctly escaped in the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can supply HTML containing event handlers that execute…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing event…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credentials…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In `route_mapper/account.lua`, `get_user_privilege` returns the complete…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,65 % · rekomendacja wg zapisanej polityki
5,3
0,65 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.