Dotkliwość: Krytyczna

Deserializacja niezaufanych danych w Microsoft SharePoint Server umożliwia zdalne wykonanie kodu.

CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin…

W Livewire v3 do 3.6.3 występuje podatność umożliwiająca zdalne wykonanie kodu przez nieautoryzowanych atakujących.

Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an…

Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to…

Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an…

Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual…

Obejście uwierzytelnienia w Quest KACE SMA pozwala na przejęcie konta administratora.

Dassault Systèmes DELMIA Apriso contains a deserialization of untrusted data vulnerability that could lead to a remote code execution.

Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands…

Samsung MagicINFO 9 Server contains a path traversal vulnerability that allows an attacker to write arbitrary file as system authority.

Luka w SAP NetWeaver Visual Composer umożliwia atakującemu kompromitację systemu przez deserializację złośliwej zawartości.

SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and…

Zdalne wykonanie kodu w Craft CMS umożliwia atakującym przejęcie kontroli nad systemem.

Brak odpowiednich uprawnień w SAP NetWeaver umożliwia nieautoryzowane przesyłanie złośliwych plików.

Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.

Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a…

Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials,…

Korupcja pamięci w systemach Apple umożliwia zdalne wykonanie kodu przez złośliwe pliki multimedialne.

Obejście uwierzytelnienia wskaźników w systemach Apple umożliwia atakującemu zdalne manipulowanie danymi.

Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products…

Wstrzyknięcie kodu w Langflow umożliwia zdalne wykonanie dowolnego kodu przez atakującego.

CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user…

Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification.…