Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Postem Ipsum plugin for WordPress is vulnerable to unauthorized modification of data to Privilege Escalation due to a missing capability check on the postem_ipsum_generate_users() function in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the plugin allowing a user to update the user role through the $user->set_role() function. This makes it possible for authenticated attackers, with Subscriber-level…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,78 % · rekomendacja wg zapisanej polityki
Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Postem Ipsum plugin for WordPress is vulnerable to unauthorized modification of data to Privilege Escalation due to a missing capability check on the postem_ipsum_generate_users() function in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the plugin allowing a user to update the user role through the $user->set_role() function. This makes it possible for authenticated attackers, with Subscriber-level…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,78 % · rekomendacja wg zapisanej polityki
Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,28 % · rekomendacja wg zapisanej polityki