Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsController#update and #destroy use an unscoped Comment.find without authorization checks. Attackers can send PUT or DELETE…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted media file may lead to…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to unexpected behavior.
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-channel webhooks pointing at internally routed…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks require human…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks require…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management.…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management.…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
CVSS
5,4
EPSS
0,23 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsController#update and #destroy use an unscoped Comment.find without authorization checks. Attackers can send PUT or DELETE…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted media file may lead to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to unexpected behavior.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-channel webhooks pointing at internally routed…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks require human…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks require…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
5,4
0,23 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.