Baza CVE

Wstrzyknięcie poleceń w Red Hat Satellite API pozwala na wykonanie dowolnych komend na infrastrukturze.

Obejście uwierzytelnienia w Foreman pozwala na dostęp do szablonu kickstart bez tokena.

Luka w wtyczce Prime Mover dla WordPressa pozwala administratorom na zapis plików poza katalogiem.

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker can submit a malformed…

Dereferencja wskaźnika NULL w mod_heartmonitor Apache HTTP Server może prowadzić do awarii serwera.

Ujawnienie wrażliwych informacji w Apache HTTP Server pozwala na przekazanie ciasteczka sesji do serwera backendowego.

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorization` header to outgoing…

Nieautoryzowane XSS w Premmerce Wishlist dla WooCommerce umożliwia atakującym wstrzyknięcie złośliwego kodu.

Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.

Contributor PHP Object Injection in Icegram <= 3.1.31 versions.

Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.

Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.

Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.

Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions.

HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic…

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local…

HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store malicious scripts within the application…

Niezautoryzowane obejście kontroli dostępu w WP Full Stripe umożliwia nieautoryzowany dostęp.

Subscriber Privilege Escalation in ByteCoreStack &#8211; MCP Connector for AI Tools <= 1.2.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.

Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions.

Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Exploiting Incorrectly Configured Access Control…

iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references (IDOR), enabling…

Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels. The line…