KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Wykorzystanie luki w ManageSieve pozwala na obejście limitów CPU dla skryptów Sieve.
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing…
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft…
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook,…
Brak weryfikacji uprawnień w WP MAPS PRO pozwala nieautoryzowanym atakującym na zdalne wykonanie kodu.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that could have allowed a blocked user to access sensitive information by establishing GraphQL subscriptions through WebSocket connections.
HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper handling of errors or exceptional conditions. This could allow an attacker to obtain sensitive technical information, including stack traces, system details, or internal paths, potentially facilitating further…
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and sibling 'to'/'first'/'second') shortcode attribute of the [wsm_showTrafficStatsList] shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the…
A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default.…
A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file app/del.php. Executing a manipulation of the argument hash can lead to improper privilege management. The attack can be launched remotely. The exploit has been published and may be used.…
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a low-privileged user that does not hold the "admin" Splunk role or the "sc_admin" Splunk Secure Gateway role could read mobile alert notification data for…
Brak walidacji salda w wtyczce Wallet System dla WooCommerce pozwala na oszustwa przy płatnościach.
Błędna walidacja wejścia w Joomla Content Editor umożliwia tworzenie ukrytych plików i nadpisywanie istniejących.
Błąd w API Platform Core pozwala na przypisanie niewłaściwego typu zasobu do właściwości relacji.
Wykorzystanie przejścia ścieżki w motionEye pozwala na odczytanie plików systemowych.
Błąd w Nezha Monitoring pozwala nieautoryzowanym użytkownikom na dostęp do danych serwerów innych użytkowników.
Tanium addressed a denial of service vulnerability in Enforce.
Out of bounds read in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
RabbitMQ is a messaging and streaming broker. Prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, accept_content/2 at line 56 calls rabbit_stream_manager:create_super_stream/... directly after is_authorized (which only checks the management tag + vhost access via is_authorized_vhost). The…
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling workspace metadata + settings tampering. The `PATCH /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(workspace_id)`…
Obejście uwierzytelnienia w Tutor LMS umożliwia nieautoryzowany dostęp do zasobów.
Wykryta podatność w Erlang OTP umożliwia kradzież danych uwierzytelniających przez przekierowania.
Błąd w IBM Db2 umożliwia uwierzytelnionemu użytkownikowi wywołanie odmowy usługi.
A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as "commonName") instead of its canonical name (such as "cn") as the new relative distinguished name. An authenticated attacker with the…
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Wykorzystanie luki w ManageSieve pozwala na obejście limitów CPU dla skryptów Sieve. | Wykorzystanie luki w ManageSieve pozwala na obejście limitów CPU dla skryptów Sieve. |
Do wiadomości | 6,5 | 0,34 % | ||
| The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. | The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing… |
Do wiadomości | 6,5 | 0,34 % | ||
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft… |
Do wiadomości | 6,5 | 0,34 % | ||
| Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook,… |
Do wiadomości | 6,5 | 0,34 % | ||
| Brak weryfikacji uprawnień w WP MAPS PRO pozwala nieautoryzowanym atakującym na zdalne wykonanie kodu. | Brak weryfikacji uprawnień w WP MAPS PRO pozwala nieautoryzowanym atakującym na zdalne wykonanie kodu. |
Do wiadomości | 6,5 | 0,34 % | ||
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before… | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that could have allowed a blocked user to access sensitive information by establishing GraphQL subscriptions through WebSocket connections. |
Do wiadomości | 6,5 | 0,34 % | ||
| HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper handling of errors or exceptional conditions. | HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper handling of errors or exceptional conditions. This could allow an attacker to obtain sensitive technical information, including stack traces, system details, or internal paths, potentially facilitating further… |
Do wiadomości | 6,5 | 0,34 % | ||
| The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and sibling… | The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and sibling 'to'/'first'/'second') shortcode attribute of the [wsm_showTrafficStatsList] shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the… |
Do wiadomości | 6,5 | 0,34 % | ||
| A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). | A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default.… |
Do wiadomości | 6,5 | 0,34 % | ||
| A flaw has been found in icret EasyImage up to 2.8.7. | A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file app/del.php. Executing a manipulation of the argument hash can lead to improper privilege management. The attack can be launched remotely. The exploit has been published and may be used.… |
Do wiadomości | 6,5 | 0,34 % | ||
| In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and… | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a low-privileged user that does not hold the "admin" Splunk role or the "sc_admin" Splunk Secure Gateway role could read mobile alert notification data for… |
Do wiadomości | 6,5 | 0,34 % | ||
| Brak walidacji salda w wtyczce Wallet System dla WooCommerce pozwala na oszustwa przy płatnościach. | Brak walidacji salda w wtyczce Wallet System dla WooCommerce pozwala na oszustwa przy płatnościach. |
Do wiadomości | 6,5 | 0,34 % | ||
| Błędna walidacja wejścia w Joomla Content Editor umożliwia tworzenie ukrytych plików i nadpisywanie istniejących. | Błędna walidacja wejścia w Joomla Content Editor umożliwia tworzenie ukrytych plików i nadpisywanie istniejących. |
Do wiadomości | 6,5 | 0,34 % | ||
| Błąd w API Platform Core pozwala na przypisanie niewłaściwego typu zasobu do właściwości relacji. | Błąd w API Platform Core pozwala na przypisanie niewłaściwego typu zasobu do właściwości relacji. |
Do wiadomości | 6,5 | 0,34 % | ||
| Wykorzystanie przejścia ścieżki w motionEye pozwala na odczytanie plików systemowych. | Wykorzystanie przejścia ścieżki w motionEye pozwala na odczytanie plików systemowych. |
Do wiadomości | 6,5 | 0,34 % | ||
| Błąd w Nezha Monitoring pozwala nieautoryzowanym użytkownikom na dostęp do danych serwerów innych użytkowników. | Błąd w Nezha Monitoring pozwala nieautoryzowanym użytkownikom na dostęp do danych serwerów innych użytkowników. |
Do wiadomości | 6,5 | 0,34 % | ||
| Tanium addressed a denial of service vulnerability in Enforce. | Tanium addressed a denial of service vulnerability in Enforce. |
Do wiadomości | 6,5 | 0,34 % | ||
| Out of bounds read in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially read memory… | Out of bounds read in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Do wiadomości | 6,5 | 0,34 % | ||
| RabbitMQ is a messaging and streaming broker. | RabbitMQ is a messaging and streaming broker. Prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, accept_content/2 at line 56 calls rabbit_stream_manager:create_super_stream/... directly after is_authorized (which only checks the management tag + vhost access via is_authorized_vhost). The… |
Do wiadomości | 6,5 | 0,34 % | ||
| PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling workspace metadata + settings tampering. The `PATCH /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(workspace_id)`… |
Do wiadomości | 6,5 | 0,34 % | ||
| Obejście uwierzytelnienia w Tutor LMS umożliwia nieautoryzowany dostęp do zasobów. | Obejście uwierzytelnienia w Tutor LMS umożliwia nieautoryzowany dostęp do zasobów. |
Do wiadomości | 6,5 | 0,34 % | ||
| Wykryta podatność w Erlang OTP umożliwia kradzież danych uwierzytelniających przez przekierowania. | Wykryta podatność w Erlang OTP umożliwia kradzież danych uwierzytelniających przez przekierowania. |
Do wiadomości | 6,5 | 0,34 % | ||
| Błąd w IBM Db2 umożliwia uwierzytelnionemu użytkownikowi wywołanie odmowy usługi. | Błąd w IBM Db2 umożliwia uwierzytelnionemu użytkownikowi wywołanie odmowy usługi. |
Do wiadomości | 6,5 | 0,34 % | ||
| A NULL pointer dereference flaw was found in 389-ds-base. | A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as "commonName") instead of its canonical name (such as "cn") as the new relative distinguished name. An authenticated attacker with the… |
Do wiadomości | 6,5 | 0,33 % | ||
| The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force… |
Do wiadomości | 6,5 | 0,33 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.