Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visitor…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call dt_verify_external_connection with a chosen endpointId and url to send stored connection…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit(), Extra::edit(), Leaves::delete(),…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read client memory. Servers can send SCardTransmit requests with an invalid card handle and nonzero receive length, causing…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. SVG images can contain clickable links or executable scripting. By uploading a crafted SVG, it is possible to execute scripting in…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to database queries used for subnet management. This could allow an authenticated attacker to read, modify, or delete subnet configurations, leading to unauthorized…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Removing Important Client Functionality.This issue affects Booking and Rental Manager: from n/a through 2.8.0.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
CVSS
5,3
EPSS
0,23 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visitor…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call dt_verify_external_connection with a chosen endpointId and url to send stored connection…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit(), Extra::edit(), Leaves::delete(),…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read client memory. Servers can send SCardTransmit requests with an invalid card handle and nonzero receive length, causing…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. SVG images can contain clickable links or executable scripting. By uploading a crafted SVG, it is possible to execute scripting in…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to database queries used for subnet management. This could allow an authenticated attacker to read, modify, or delete subnet configurations, leading to unauthorized…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Removing Important Client Functionality.This issue affects Booking and Rental Manager: from n/a through 2.8.0.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
5,3
0,23 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.