Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle JavaFX:…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMTP to compromise Siebel Apps - Marketing. Successful…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK:…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http1). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted tokens…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission. Attackers can set a join password, disable registration, zero upload…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Web Client). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle Secure Backup (component: NDMP daemon). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup. Successful attacks of this…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permission(false) in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks.…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerability in report_sql::prepare_sql() via the filter_var request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTER_VAR%% placeholder can…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
CVSS
5,3
EPSS
0,32 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle JavaFX:…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMTP to compromise Siebel Apps - Marketing. Successful…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK:…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http1). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted tokens…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission. Attackers can set a join password, disable registration, zero upload…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Web Client). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle Secure Backup (component: NDMP daemon). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup. Successful attacks of this…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permission(false) in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerability in report_sql::prepare_sql() via the filter_var request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTER_VAR%% placeholder can…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
5,3
0,32 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.