Błąd uwierzytelniania w Gmission Web Fax umożliwia eskalację uprawnień.
Błąd uwierzytelniania w Gmission Web Fax umożliwia eskalację uprawnień.
- CVSS
- 9,8
- EPSS
- 0,32 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
KATALOG INFORMACJI
Dotkliwość: Krytyczna
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Filtry katalogu · zakres, producent, rekomendacja
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6.
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. Users with the "Manage roles and permissions" privilege can promote themselves or other DOC users to the Supervisor role through an API call. This privilege is included by default in the…
- CVSS
- 9,8
- EPSS
- 0,32 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level…
Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any attacker to access the Setting Center. This means that this is effectively backdoor for all devices utilizing a Growatt…
- CVSS
- 9,8
- EPSS
- 0,32 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug…
The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and to extracting secrets or domains from within the device
- CVSS
- 9,8
- EPSS
- 0,32 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP…
ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the server. This may allow an attacker to replace legitimate files being deployed to devices with their own malicious versions, since the firmware…
- CVSS
- 9,8
- EPSS
- 0,32 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impersonated simply by…
Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impersonated simply by knowing their 'numerical ID', meaning that an attacker could compromise another user's account, thereby affecting the confidentiality, integrity, and…
- CVSS
- 9,8
- EPSS
- 0,32 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection.
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection.
- CVSS
- 9,8
- EPSS
- 0,32 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Obejście ochrony hasłem w DVP-12SE11T umożliwia nieautoryzowany dostęp.
Obejście ochrony hasłem w DVP-12SE11T umożliwia nieautoryzowany dostęp.
- CVSS
- 9,8
- EPSS
- 0,32 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665.
A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. This affects the function check/uncheck/delete of the file application/Comment/Controller/CommentadminController.class.php of the component CommentadminController. The manipulation of the argument…
- CVSS
- 9,8
- EPSS
- 0,32 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Memory safety bugs present in Thunderbird ESR 140.12.
Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and…
- CVSS
- 9,8
- EPSS
- 0,32 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .
A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .
- CVSS
- 9,8
- EPSS
- 0,31 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object…
Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.
- CVSS
- 9,8
- EPSS
- 0,31 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue…
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
- CVSS
- 9,8
- EPSS
- 0,31 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
- CVSS
- 9,8
- EPSS
- 0,31 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
- CVSS
- 9,8
- EPSS
- 0,31 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
- CVSS
- 9,8
- EPSS
- 0,31 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
- CVSS
- 9,8
- EPSS
- 0,31 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
- CVSS
- 9,8
- EPSS
- 0,31 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
- CVSS
- 9,8
- EPSS
- 0,31 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
- CVSS
- 9,8
- EPSS
- 0,31 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
- CVSS
- 9,8
- EPSS
- 0,31 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
- CVSS
- 9,8
- EPSS
- 0,31 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
- CVSS
- 9,8
- EPSS
- 0,31 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
- CVSS
- 9,8
- EPSS
- 0,31 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
- CVSS
- 9,8
- EPSS
- 0,31 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Błąd uwierzytelniania w Gmission Web Fax umożliwia eskalację uprawnień. | Błąd uwierzytelniania w Gmission Web Fax umożliwia eskalację uprawnień. |
W tym tygodniu | 9,8 | 0,32 % | ||
| An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. | An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. Users with the "Manage roles and permissions" privilege can promote themselves or other DOC users to the Supervisor role through an API call. This privilege is included by default in the… |
W tym tygodniu | 9,8 | 0,32 % | ||
| Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level… | Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any attacker to access the Setting Center. This means that this is effectively backdoor for all devices utilizing a Growatt… |
W tym tygodniu | 9,8 | 0,32 % | ||
| The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug… | The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and to extracting secrets or domains from within the device |
W tym tygodniu | 9,8 | 0,32 % | ||
| ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP… | ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the server. This may allow an attacker to replace legitimate files being deployed to devices with their own malicious versions, since the firmware… |
W tym tygodniu | 9,8 | 0,32 % | ||
| Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impersonated simply by… | Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impersonated simply by knowing their 'numerical ID', meaning that an attacker could compromise another user's account, thereby affecting the confidentiality, integrity, and… |
W tym tygodniu | 9,8 | 0,32 % | ||
| IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection. | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection. |
W tym tygodniu | 9,8 | 0,32 % | ||
| Obejście ochrony hasłem w DVP-12SE11T umożliwia nieautoryzowany dostęp. | Obejście ochrony hasłem w DVP-12SE11T umożliwia nieautoryzowany dostęp. |
W tym tygodniu | 9,8 | 0,32 % | ||
| A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. | A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. This affects the function check/uncheck/delete of the file application/Comment/Controller/CommentadminController.class.php of the component CommentadminController. The manipulation of the argument… |
W tym tygodniu | 9,8 | 0,32 % | ||
| Memory safety bugs present in Thunderbird ESR 140.12. | Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and… |
W tym tygodniu | 9,8 | 0,32 % | ||
| A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . | A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . |
W tym tygodniu | 9,8 | 0,31 % | ||
| Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object… | Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue… | Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. | Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. | Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. | Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. | Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions. | Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions. | Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in Windsor <= 2.10 versions. | Unauthenticated PHP Object Injection in Windsor <= 2.10 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. | Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions. | Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in Law Office <= 3.20 versions. | Unauthenticated PHP Object Injection in Law Office <= 3.20 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in Invetex <= 2.18 versions. | Unauthenticated PHP Object Injection in Invetex <= 2.18 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions. | Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions. |
W tym tygodniu | 9,8 | 0,31 % |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.