KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the…
Odczyt poza granicami w ANGLE w Google Chrome umożliwia wyciek danych między źródłami.
Wykorzystanie operatorów trim w MongoDB może prowadzić do 100% obciążenia CPU przez uwierzytelnionego użytkownika.
Przechowywanie haseł w formacie umożliwiającym ich odzyskanie w FortiSOAR pozwala na ich wykradzenie.
Wykorzystanie podatności w FoundationAgents MetaGPT umożliwia atak typu server-side request forgery.
Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string (for example a JSON object such as…
NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private and link-local hosts…
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK:…
For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from…
Warunek wyścigu w Grafana Live pozwala użytkownikom z rolą Viewer na awarię serwera.
Denial of service w fast-jwt pozwala na wysokie zużycie CPU przy weryfikacji JWT.
Przepełnienie całkowitej liczby w OpenEXR może prowadzić do awarii procesu.
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authorization flaw in card update handling allows board members (and potentially other authenticated users) to add/remove arbitrary user IDs in vote.positive / vote.negative arrays, enabling…
In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a generic error message, the system exposes internal backend information, including the use of the Yii framework, the MySQL/MariaDB database…
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid' parameter in all versions up to, and including, 1.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.…
The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthenticated attackers to reassign the login, registration and password-recovery slugs and lock the administrator out of the…
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: LDAP). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.…
Luka w MySQL Shell umożliwia nieautoryzowany dostęp do krytycznych danych.
Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise…
Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise…
Vulnerability in the PeopleSoft Enterprise FIN Project Costing product of Oracle PeopleSoft (component: Projects). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN…
Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM…
Brak autoryzacji w Gutenverse Form umożliwia nieprawidłowe skonfigurowanie poziomów dostępu.
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This…
The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Open Zaak is an open-source data and services layer for Dutch case-oriented working. | Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the… |
Do wiadomości | 6,5 | 0,26 % | ||
| Odczyt poza granicami w ANGLE w Google Chrome umożliwia wyciek danych między źródłami. | Odczyt poza granicami w ANGLE w Google Chrome umożliwia wyciek danych między źródłami. |
Do wiadomości | 6,5 | 0,26 % | ||
| Wykorzystanie operatorów trim w MongoDB może prowadzić do 100% obciążenia CPU przez uwierzytelnionego użytkownika. | Wykorzystanie operatorów trim w MongoDB może prowadzić do 100% obciążenia CPU przez uwierzytelnionego użytkownika. |
Do wiadomości | 6,5 | 0,26 % | ||
| Przechowywanie haseł w formacie umożliwiającym ich odzyskanie w FortiSOAR pozwala na ich wykradzenie. | Przechowywanie haseł w formacie umożliwiającym ich odzyskanie w FortiSOAR pozwala na ich wykradzenie. |
Do wiadomości | 6,5 | 0,26 % | ||
| Wykorzystanie podatności w FoundationAgents MetaGPT umożliwia atak typu server-side request forgery. | Wykorzystanie podatności w FoundationAgents MetaGPT umożliwia atak typu server-side request forgery. |
Do wiadomości | 6,5 | 0,26 % | ||
| Waline is a comment system with backend support. | Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string (for example a JSON object such as… |
Do wiadomości | 6,5 | 0,26 % | ||
| NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the… | NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private and link-local hosts… |
Do wiadomości | 6,5 | 0,26 % | ||
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:… | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK:… |
Do wiadomości | 6,5 | 0,26 % | ||
| For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow… | For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from… |
Do wiadomości | 6,5 | 0,26 % | ||
| Warunek wyścigu w Grafana Live pozwala użytkownikom z rolą Viewer na awarię serwera. | Warunek wyścigu w Grafana Live pozwala użytkownikom z rolą Viewer na awarię serwera. |
Do wiadomości | 6,5 | 0,26 % | ||
| Denial of service w fast-jwt pozwala na wysokie zużycie CPU przy weryfikacji JWT. | Denial of service w fast-jwt pozwala na wysokie zużycie CPU przy weryfikacji JWT. |
Do wiadomości | 6,5 | 0,26 % | ||
| Przepełnienie całkowitej liczby w OpenEXR może prowadzić do awarii procesu. | Przepełnienie całkowitej liczby w OpenEXR może prowadzić do awarii procesu. |
Do wiadomości | 6,5 | 0,26 % | ||
| An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authorization flaw in card update handling allows board members (and potentially other authenticated users) to add/remove arbitrary user IDs in vote.positive / vote.negative arrays, enabling… |
Do wiadomości | 6,5 | 0,26 % | ||
| In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. | In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a generic error message, the system exposes internal backend information, including the use of the Yii framework, the MySQL/MariaDB database… |
Do wiadomości | 6,5 | 0,26 % | ||
| The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid' parameter in all… | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid' parameter in all versions up to, and including, 1.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.… |
Do wiadomości | 6,5 | 0,26 % | ||
| The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL… | The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthenticated attackers to reassign the login, registration and password-recovery slugs and lock the administrator out of the… |
Do wiadomości | 6,5 | 0,26 % | ||
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: LDAP). | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: LDAP). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.… |
Do wiadomości | 6,5 | 0,26 % | ||
| Luka w MySQL Shell umożliwia nieautoryzowany dostęp do krytycznych danych. | Luka w MySQL Shell umożliwia nieautoryzowany dostęp do krytycznych danych. |
Do wiadomości | 6,5 | 0,26 % | ||
| Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management). | Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise… |
Do wiadomości | 6,5 | 0,26 % | ||
| Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management). | Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise… |
Do wiadomości | 6,5 | 0,26 % | ||
| Vulnerability in the PeopleSoft Enterprise FIN Project Costing product of Oracle PeopleSoft (component: Projects). | Vulnerability in the PeopleSoft Enterprise FIN Project Costing product of Oracle PeopleSoft (component: Projects). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN… |
Do wiadomości | 6,5 | 0,26 % | ||
| Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). | Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM… |
Do wiadomości | 6,5 | 0,26 % | ||
| Brak autoryzacji w Gutenverse Form umożliwia nieprawidłowe skonfigurowanie poziomów dostępu. | Brak autoryzacji w Gutenverse Form umożliwia nieprawidłowe skonfigurowanie poziomów dostępu. |
Do wiadomości | 6,5 | 0,26 % | ||
| A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. | A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This… |
Do wiadomości | 6,5 | 0,26 % | ||
| The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only… | The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the… |
Do wiadomości | 6,5 | 0,26 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.