Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key has…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
A privilege escalation vulnerability exists in the API of AOS-S. Successful exploitation could allow an authenticated read-only user to escalate their privileges and gain administrative access to the affected system.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
An improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Manager, where application functionality may be invoked by untrusted sources. Successful exploitation could allow an unauthenticated remote attacker, with user interaction, to…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects OctoCloud: from 1.12.06 before 1.12.07.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Information leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Incorrect authorization in Transactions Platform in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Incorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Incorrect authorization in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
CVSS
8,8
EPSS
0,24 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key has…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
A privilege escalation vulnerability exists in the API of AOS-S. Successful exploitation could allow an authenticated read-only user to escalate their privileges and gain administrative access to the affected system.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
An improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Manager, where application functionality may be invoked by untrusted sources. Successful exploitation could allow an unauthenticated remote attacker, with user interaction, to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects OctoCloud: from 1.12.06 before 1.12.07.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Information leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Incorrect authorization in Transactions Platform in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Incorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Incorrect authorization in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
8,8
0,24 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.