Podatności

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to…

CVSS 7,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Portal Suite). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise…

CVSS 7,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.…

CVSS 7,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). The supported version that is affected is 8.5.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…

CVSS 7,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the…

CVSS 7,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PsAdmin). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the…

CVSS 7,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment…

CVSS 7,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the…

CVSS 7,5 · EPSS 0,18 % · rekomendacja wg zapisanej polityki

The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes…

CVSS 7,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.

CVSS 7,5 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to…

CVSS 7,5 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and…

CVSS 7,5 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.

CVSS 7,5 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

Vulnerability in Oracle Java SE (component: Java plugin). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE.…

CVSS 7,5 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.20. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise…

CVSS 7,5 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in…

CVSS 7,5 · EPSS 0,11 % · rekomendacja wg zapisanej polityki

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.

CVSS 7,5 · rekomendacja wg zapisanej polityki

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one…

CVSS 7,5 · rekomendacja wg zapisanej polityki

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1,…

CVSS 7,5 · rekomendacja wg zapisanej polityki

Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data. Root Cause: The bRPC mcpack2pb parser (used to serve nshead_mcpack / ubrpc / public_pbrpc requests)…

CVSS 7,5 · rekomendacja wg zapisanej polityki

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during…

CVSS 7,5 · rekomendacja wg zapisanej polityki

Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler…

CVSS 7,5 · rekomendacja wg zapisanej polityki

Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header with a known username and empty password, triggering an…

CVSS 7,4 · EPSS 0,48 % · rekomendacja wg zapisanej polityki

OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the…

CVSS 7,4 · EPSS 0,43 % · rekomendacja wg zapisanej polityki

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to…

CVSS 7,4 · EPSS 0,35 % · rekomendacja wg zapisanej polityki