KATALOG INFORMACJI
Chronologiczny przegląd publikacji. Ostatnie modyfikacje są w osobnym widoku.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices.
A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.
A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.
A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has…
A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiated…
Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only…
The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the…
A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.
A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.
The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website…
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.
The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are…
The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can…
The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query.…
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its…
The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown…
The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics…
The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.
The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored XSS.This issue affects Brizy: 2.8.23.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for… | A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices. |
Do wiadomości | 6,3 | 0,1 % | ||
| A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution. | A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution. |
Obserwuj | 7,5 | 0,59 % | ||
| A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve… | A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes. |
Obserwuj | 8,6 | 0,71 % | ||
| A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service. | A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service. |
Obserwuj | 8,6 | 0,7 % | ||
| A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution. | A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution. |
Obserwuj | 8,6 | 0,74 % | ||
| A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. | A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has… |
Do wiadomości | 1,9 | 0,73 % | ||
| A weakness has been identified in Osclass up to 8.3.1. | A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiated… |
Do wiadomości | 5,5 | 0,39 % | ||
| Values entered by visitors were placed into the HTML summary email without being escaped. | Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient. |
Do wiadomości | 5,3 | 0,46 % | ||
| In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can… | In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only… |
Obserwuj | 7,1 | 0,35 % | ||
| The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. | The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the… |
Do wiadomości | 6,9 | 0,44 % | ||
| A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data. | A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data. |
Do wiadomości | 6,9 | 0,43 % | ||
| A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system. | A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system. |
Obserwuj | 8,6 | 1,31 % | ||
| The backend module does not check whether a backend user has access to the requested site. | The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site. |
Do wiadomości | 5,3 | 0,32 % | ||
| The extension no longer applied its access protection to files in file storages that use a non-default relative base path. | The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website… |
Do wiadomości | 6,3 | 0,47 % | ||
| The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. | The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to. |
Do wiadomości | 5,3 | 0,32 % | ||
| The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns… | The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are… |
Do wiadomości | 6,9 | 0,44 % | ||
| The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. | The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can… |
Do wiadomości | 6,9 | 0,39 % | ||
| The file search of the extension builds its database conditions by wrapping the search term in quotes itself. | The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query.… |
Obserwuj | 8,7 | 0,45 % | ||
| The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. | The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its… |
Obserwuj | 7,2 | 0,35 % | ||
| The download link for files uploaded through a form relied on a token that could be predicted. | The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown… |
Do wiadomości | 6,3 | 0,39 % | ||
| The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a… | The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics… |
Obserwuj | 7,1 | 0,37 % | ||
| The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the… | The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation. |
Do wiadomości | 5,3 | 0,32 % | ||
| The JSON import of the cookie consent configuration did not respect the backend user's permissions. | The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website. |
Obserwuj | 7,1 | 0,44 % | ||
| The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. | The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature… |
Do wiadomości | 6,9 | 0,38 % | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored… | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored XSS.This issue affects Brizy: 2.8.23. |
Do wiadomości | 6,5 | 0,2 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.