Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This is due to the `papr_restrict_page_post_rest_api()` function, hooked on `rest_pre_dispatch`, re-authenticating the current user from the `wordpress_logged_in`…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.1 through 7.4.6, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.6, FortiAnalyzer Cloud…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted_jar_paths'.
The startup flag 'trusted_jar_paths' references URIs for loading files from local or remote filesystems.…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based SQL Injection via the "getTermsForAjax" function in all versions up to, and including, 3.40.1. This is due to insufficient escaping on the user supplied parameters and lack of…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Improper Input Validation vulnerability in Apache Camel Tika component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
The Tika producer mapped every metadata key parsed out of the submitted document onto the Exchange as a header, with no filter applied.…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
The guard that prevents a request header being reflected into the response compared header names case sensitively,…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the search_name and search_email GET parameters into both the user-list query and the COUNT query used for pagination without…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag: scope values. extractscopes/1 parses scopes of the form .tag: and calls rabbitdatacoercion:toatom() to convert to a tag atom. The token signature is…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
CVSS
6,5
EPSS
0,34 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This is due to the `papr_restrict_page_post_rest_api()` function, hooked on `rest_pre_dispatch`, re-authenticating the current user from the `wordpress_logged_in`…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.1 through 7.4.6, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.6, FortiAnalyzer Cloud…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted_jar_paths'.
The startup flag 'trusted_jar_paths' references URIs for loading files from local or remote filesystems.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based SQL Injection via the "getTermsForAjax" function in all versions up to, and including, 3.40.1. This is due to insufficient escaping on the user supplied parameters and lack of…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Improper Input Validation vulnerability in Apache Camel Tika component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
The Tika producer mapped every metadata key parsed out of the submitted document onto the Exchange as a header, with no filter applied.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
The guard that prevents a request header being reflected into the response compared header names case sensitively,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the search_name and search_email GET parameters into both the user-list query and the COUNT query used for pagination without…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag: scope values. extractscopes/1 parses scopes of the form .tag: and calls rabbitdatacoercion:toatom() to convert to a tag atom. The token signature is…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
6,5
0,34 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.