Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 8,96 % · rekomendacja wg zapisanej polityki
The Starter Templates plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.4.41. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file.…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 13,51 % · rekomendacja wg zapisanej polityki
ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond…
Opis źródłowy NVD · ENCVSS 10,0 · EPSS 7,24 % · rekomendacja wg zapisanej polityki
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST…
Opis źródłowy NVD · ENCVSS 9,9 · EPSS 7,55 % · rekomendacja wg zapisanej polityki
An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system.
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 9,94 % · rekomendacja wg zapisanej polityki
The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly validating the 'role' parameter when creating new users via the `/fox-lms/v1/payments/create-order` REST API endpoint.…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 6,81 % · rekomendacja wg zapisanej polityki
Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution. The system may be vulnerable when specially crafted input is used to exploit the vulnerability resulting in high impact on confidentiality, integrity and…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 9,48 % · rekomendacja wg zapisanej polityki
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject(). If an…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 5,91 % · rekomendacja wg zapisanej polityki
Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functionality. An authenticated Cacti user can supply crafted SNMP community strings containing control characters (including newlines) that are…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 10,81 % · rekomendacja wg zapisanej polityki
CVSS
8,8
EPSS
10,81 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 8,96 % · rekomendacja wg zapisanej polityki
The Starter Templates plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.4.41. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file.…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 13,51 % · rekomendacja wg zapisanej polityki
ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 10,0 · EPSS 7,24 % · rekomendacja wg zapisanej polityki
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,9 · EPSS 7,55 % · rekomendacja wg zapisanej polityki
An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 9,94 % · rekomendacja wg zapisanej polityki
The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly validating the 'role' parameter when creating new users via the `/fox-lms/v1/payments/create-order` REST API endpoint.…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 6,81 % · rekomendacja wg zapisanej polityki
Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution. The system may be vulnerable when specially crafted input is used to exploit the vulnerability resulting in high impact on confidentiality, integrity and…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 9,48 % · rekomendacja wg zapisanej polityki
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject(). If an…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 5,91 % · rekomendacja wg zapisanej polityki
Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functionality. An authenticated Cacti user can supply crafted SNMP community strings containing control characters (including newlines) that are…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 10,81 % · rekomendacja wg zapisanej polityki
8,8
10,81 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.