Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using the legacy personal access token helper. Attackers with a read-only UAT can POST to the project alertChannels endpoint to create…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFX_MAP_SURFACE_TO_WINDOW_PDU with oversized…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit.…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-health). Supported versions that are affected are 3.0.0-3.2.21, 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An attacker holding any tenant's API key who knows a victim's run friendlyId can replay that run into their own environment and read…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Search Framework). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
CVSS
5,3
EPSS
0,15 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using the legacy personal access token helper. Attackers with a read-only UAT can POST to the project alertChannels endpoint to create…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFX_MAP_SURFACE_TO_WINDOW_PDU with oversized…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-health). Supported versions that are affected are 3.0.0-3.2.21, 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An attacker holding any tenant's API key who knows a victim's run friendlyId can replay that run into their own environment and read…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Search Framework). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
5,3
0,15 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.