Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses…
Opis źródłowy NVD · ENCVSS 4,4 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.
This issue affects Vyond: before fb10a5c8b833df7f152d4a563a61d6090a1790d7.
Opis źródłowy NVD · ENCVSS 4,4 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.
This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa.
Opis źródłowy NVD · ENCVSS 4,4 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,47 % · rekomendacja wg zapisanej polityki
Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue titles and bodies that should be hidden by the owner's visibility policy. Keyword matching can also…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure concerns public key…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversized body to a checksum endpoint despite legitimate checksum values being at most 128 bytes. This…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download those packages despite the visibility policy that should prevent this access. The issue affects…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activity records and contribution timestamps that the corresponding profile routes deny. Exposed activity…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create repositories can…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redirect of the file plugins/_userInfo/_userInfo.php of the component Login Redirect. This manipulation of the argument callback causes open redirect. The attack can be initiated…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an email to a monitored group or IMAP address, including an email-to-Case address, and place arbitrary HTML in its plain-text body. EspoCRM stores that body and…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private organizations, bypassing…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.3 via the 'params[customer][first_name]' parameter. This makes it possible for authenticated attackers,…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission. A member with only Wiki access to a private repository can submit a markup preview request and retrieve a private pull request's title and state icon despite…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keys_conversion_map' parameter. This makes it possible for authenticated attackers, with contributor-level access…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling the gateway can set MsgBytes far larger than the NDR string ActualCount in consent or service messages,…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'image_hub_api_keys_* (6 options)' parameter. This makes it possible for authenticated attackers,…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/{departmentId} with arbitrary department ids to retrieve usernames,…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
CVSS
4,3
EPSS
0,27 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,4 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.
This issue affects Vyond: before fb10a5c8b833df7f152d4a563a61d6090a1790d7.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,4 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.
This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,4 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,47 % · rekomendacja wg zapisanej polityki
Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue titles and bodies that should be hidden by the owner's visibility policy. Keyword matching can also…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure concerns public key…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversized body to a checksum endpoint despite legitimate checksum values being at most 128 bytes. This…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download those packages despite the visibility policy that should prevent this access. The issue affects…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activity records and contribution timestamps that the corresponding profile routes deny. Exposed activity…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create repositories can…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redirect of the file plugins/_userInfo/_userInfo.php of the component Login Redirect. This manipulation of the argument callback causes open redirect. The attack can be initiated…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an email to a monitored group or IMAP address, including an email-to-Case address, and place arbitrary HTML in its plain-text body. EspoCRM stores that body and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, can retrieve organization metadata visible to its owner. For a site administrator's token, the response can include Limited and private organizations, bypassing…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.3 via the 'params[customer][first_name]' parameter. This makes it possible for authenticated attackers,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission. A member with only Wiki access to a private repository can submit a markup preview request and retrieve a private pull request's title and state icon despite…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keys_conversion_map' parameter. This makes it possible for authenticated attackers, with contributor-level access…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths. Attackers controlling the gateway can set MsgBytes far larger than the NDR string ActualCount in consent or service messages,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'image_hub_api_keys_* (6 options)' parameter. This makes it possible for authenticated attackers,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/{departmentId} with arbitrary department ids to retrieve usernames,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
4,3
0,27 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.