Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/{id}, which skips the…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
An Improper Handling of Length Parameter Inconsistency vulnerability in L2ALM of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to obtain stale PFE packet memory via VXLAN overlay-ping traffic sent to a local VTEP.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp_Decode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending with a strict-array type byte and fewer…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users'…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, all 19.3 versions, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system notes on public projects due to…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TC_DYNAMIC_SECURITY constant being hardcoded to a publicly known value. This makes it possible for…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Availability of the application.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
CVSS
5,3
EPSS
0,2 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level security by fetching individual stream notes. Users with stream access to a parent record can request GET /Note/{id}, which skips the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
An Improper Handling of Length Parameter Inconsistency vulnerability in L2ALM of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to obtain stale PFE packet memory via VXLAN overlay-ping traffic sent to a local VTEP.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp_Decode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending with a strict-array type byte and fewer…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users'…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, all 19.3 versions, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system notes on public projects due to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TC_DYNAMIC_SECURITY constant being hardcoded to a publicly known value. This makes it possible for…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Availability of the application.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
5,3
0,2 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.