KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Nieautoryzowane odniesienia do obiektów w License Manager for WooCommerce umożliwiają dostęp do danych.
Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PPOM for WooCommerce: from n/a through 33.0.18.
Luka w kontroli dostępu w Turms IM Server pozwala uwierzytelnionym użytkownikom na dostęp do statusów online innych użytkowników.
Due to an Information Disclosure vulnerability in Application Server ABAP, an authenticated attacker could read unmasked values displayed in ABAP Lists. Successful exploitation could lead to unauthorized disclosure of data, resulting in a high impact on confidentiality without affecting integrity…
Nieprawidłowa walidacja danych w usłudze Netconf w Infinera MTC-9 pozwala na zdalne wywołanie awarii.
Luka w systemie logowania Cisco RoomOS pozwala lokalnemu atakującemu na dostęp do wrażliwych danych.
Błąd w analizie pakietów w CocoaMQTT pozwala na zdalne zablokowanie aplikacji iOS/macOS.
A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it…
Incorrect reference resolution in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Use after free in Browser in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Missing authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Type confusion in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Type confusion in Fonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Incorrect authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
Missing authorization in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Race condition in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Incorrect authorization in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Błąd kontroli dostępu w Aruba Migration Tool pozwala na nieautoryzowany dostęp do danych.
Błędne rozwiązanie odniesienia w MediaStream w Google Chrome umożliwia obejście polityki pochodzenia.
RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive # segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization.…
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing…
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, match_value/3 passes the user-supplied ?name= regular expression to re:run with no match_limit option, and executes it once per resource in the result set. OTP's default 10M match_limit caps…
Ujawnienie informacji w komponencie Graphics: ImageLib w Firefox umożliwia dostęp do wrażliwych danych.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Nieautoryzowane odniesienia do obiektów w License Manager for WooCommerce umożliwiają dostęp do danych. | Nieautoryzowane odniesienia do obiektów w License Manager for WooCommerce umożliwiają dostęp do danych. |
Do wiadomości | 6,5 | 0,33 % | ||
| Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security… | Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PPOM for WooCommerce: from n/a through 33.0.18. |
Do wiadomości | 6,5 | 0,33 % | ||
| Luka w kontroli dostępu w Turms IM Server pozwala uwierzytelnionym użytkownikom na dostęp do statusów online innych użytkowników. | Luka w kontroli dostępu w Turms IM Server pozwala uwierzytelnionym użytkownikom na dostęp do statusów online innych użytkowników. |
Do wiadomości | 6,5 | 0,33 % | ||
| Due to an Information Disclosure vulnerability in Application Server ABAP, an authenticated attacker could read unmasked values displayed… | Due to an Information Disclosure vulnerability in Application Server ABAP, an authenticated attacker could read unmasked values displayed in ABAP Lists. Successful exploitation could lead to unauthorized disclosure of data, resulting in a high impact on confidentiality without affecting integrity… |
Do wiadomości | 6,5 | 0,33 % | ||
| Nieprawidłowa walidacja danych w usłudze Netconf w Infinera MTC-9 pozwala na zdalne wywołanie awarii. | Nieprawidłowa walidacja danych w usłudze Netconf w Infinera MTC-9 pozwala na zdalne wywołanie awarii. |
Do wiadomości | 6,5 | 0,33 % | ||
| Luka w systemie logowania Cisco RoomOS pozwala lokalnemu atakującemu na dostęp do wrażliwych danych. | Luka w systemie logowania Cisco RoomOS pozwala lokalnemu atakującemu na dostęp do wrażliwych danych. |
Do wiadomości | 6,5 | 0,33 % | ||
| Błąd w analizie pakietów w CocoaMQTT pozwala na zdalne zablokowanie aplikacji iOS/macOS. | Błąd w analizie pakietów w CocoaMQTT pozwala na zdalne zablokowanie aplikacji iOS/macOS. |
Do wiadomości | 6,5 | 0,33 % | ||
| A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain… | A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it… |
Do wiadomości | 6,5 | 0,33 % | ||
| Incorrect reference resolution in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering… | Incorrect reference resolution in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Do wiadomości | 6,5 | 0,33 % | ||
| Use after free in Browser in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code… | Use after free in Browser in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Do wiadomości | 6,5 | 0,33 % | ||
| Missing authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process… | Missing authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
Do wiadomości | 6,5 | 0,33 % | ||
| Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a… | Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Do wiadomości | 6,5 | 0,33 % | ||
| Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social… | Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Do wiadomości | 6,5 | 0,33 % | ||
| Type confusion in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code… | Type confusion in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Do wiadomości | 6,5 | 0,33 % | ||
| Type confusion in Fonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to read memory… | Type confusion in Fonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Do wiadomości | 6,5 | 0,33 % | ||
| Incorrect authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the… | Incorrect authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
Do wiadomości | 6,5 | 0,33 % | ||
| Missing authorization in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer… | Missing authorization in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
Do wiadomości | 6,5 | 0,33 % | ||
| Race condition in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass… | Race condition in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
Do wiadomości | 6,5 | 0,33 % | ||
| Incorrect authorization in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social… | Incorrect authorization in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Do wiadomości | 6,5 | 0,33 % | ||
| Błąd kontroli dostępu w Aruba Migration Tool pozwala na nieautoryzowany dostęp do danych. | Błąd kontroli dostępu w Aruba Migration Tool pozwala na nieautoryzowany dostęp do danych. |
Do wiadomości | 6,5 | 0,33 % | ||
| Błędne rozwiązanie odniesienia w MediaStream w Google Chrome umożliwia obejście polityki pochodzenia. | Błędne rozwiązanie odniesienia w MediaStream w Google Chrome umożliwia obejście polityki pochodzenia. |
Do wiadomości | 6,5 | 0,33 % | ||
| RabbitMQ is a messaging and streaming broker. | RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive # segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization.… |
Do wiadomości | 6,5 | 0,33 % | ||
| RabbitMQ is a messaging and streaming broker. | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing… |
Do wiadomości | 6,5 | 0,33 % | ||
| RabbitMQ is a messaging and streaming broker. | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, match_value/3 passes the user-supplied ?name= regular expression to re:run with no match_limit option, and executes it once per resource in the result set. OTP's default 10M match_limit caps… |
Do wiadomości | 6,5 | 0,33 % | ||
| Ujawnienie informacji w komponencie Graphics: ImageLib w Firefox umożliwia dostęp do wrażliwych danych. | Ujawnienie informacji w komponencie Graphics: ImageLib w Firefox umożliwia dostęp do wrażliwych danych. |
Do wiadomości | 6,5 | 0,33 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.