Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 28,31 % · rekomendacja wg zapisanej polityki
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability.
The specific flaw…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 26,26 % · rekomendacja wg zapisanej polityki
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 24,72 % · rekomendacja wg zapisanej polityki
A flaw has been found in Edimax BR-6478AC V3 1.0.15. The affected element is the function sub_44CCE4 of the file /boafrm/formSysCmd. This manipulation of the argument sysCmd causes os command injection. The attack may be initiated remotely. The exploit has been published and may be used. The…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 20,32 % · rekomendacja wg zapisanej polityki
A vulnerability was detected in Edimax BR-6478AC V3 1.0.15. Impacted is the function sub_416990 of the file /boafrm/formTracerouteDiagnosticRun. The manipulation of the argument host results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 19,57 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in UTT 进取 750W up to 3.2.2-191225. Affected by this vulnerability is the function system of the file /goform/formPdbUpConfig. Such manipulation of the argument policyNames leads to command injection. The attack may be launched remotely. The exploit has…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 19,54 % · rekomendacja wg zapisanej polityki
The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.
Opis źródłowy NVD · ENCVSS 9,0 · EPSS 22,11 % · rekomendacja wg zapisanej polityki
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.
In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 16,91 % · rekomendacja wg zapisanej polityki
An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba functionality, potentially leading to allow execution of specific functions without proper authorization.
Refer to the Security Update for ASUS Router Firmware…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 15,76 % · rekomendacja wg zapisanej polityki
pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 12,71 % · rekomendacja wg zapisanej polityki
A vulnerability was found in Shiguangwu sgwbox N3 2.0.25. The impacted element is an unknown function of the file /eshell of the component API. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 12,49 % · rekomendacja wg zapisanej polityki
n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide. An authenticated user with permission to create or modify workflows can exploit this vulnerability to execute arbitrary commands…
Opis źródłowy NVD · ENCVSS 9,9 · EPSS 11,93 % · rekomendacja wg zapisanej polityki
CVSS
9,9
EPSS
11,93 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 28,31 % · rekomendacja wg zapisanej polityki
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability.
The specific flaw…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 26,26 % · rekomendacja wg zapisanej polityki
Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload.
Opis źródłowy NVD · EN
Pilne działanie
CVSS 9,8 · EPSS 24,72 % · rekomendacja wg zapisanej polityki
A flaw has been found in Edimax BR-6478AC V3 1.0.15. The affected element is the function sub_44CCE4 of the file /boafrm/formSysCmd. This manipulation of the argument sysCmd causes os command injection. The attack may be initiated remotely. The exploit has been published and may be used. The…
Opis źródłowy NVD · EN
Pilne działanie
CVSS 9,8 · EPSS 20,32 % · rekomendacja wg zapisanej polityki
A vulnerability was detected in Edimax BR-6478AC V3 1.0.15. Impacted is the function sub_416990 of the file /boafrm/formTracerouteDiagnosticRun. The manipulation of the argument host results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.…
Opis źródłowy NVD · EN
Pilne działanie
CVSS 9,8 · EPSS 19,57 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in UTT 进取 750W up to 3.2.2-191225. Affected by this vulnerability is the function system of the file /goform/formPdbUpConfig. Such manipulation of the argument policyNames leads to command injection. The attack may be launched remotely. The exploit has…
Opis źródłowy NVD · EN
Pilne działanie
CVSS 9,8 · EPSS 19,54 % · rekomendacja wg zapisanej polityki
The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,0 · EPSS 22,11 % · rekomendacja wg zapisanej polityki
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.
In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 16,91 % · rekomendacja wg zapisanej polityki
An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba functionality, potentially leading to allow execution of specific functions without proper authorization.
Refer to the Security Update for ASUS Router Firmware…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 15,76 % · rekomendacja wg zapisanej polityki
pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 12,71 % · rekomendacja wg zapisanej polityki
A vulnerability was found in Shiguangwu sgwbox N3 2.0.25. The impacted element is an unknown function of the file /eshell of the component API. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor…
Opis źródłowy NVD · EN
Pilne działanie
CVSS 9,8 · EPSS 12,49 % · rekomendacja wg zapisanej polityki
n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide. An authenticated user with permission to create or modify workflows can exploit this vulnerability to execute arbitrary commands…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,9 · EPSS 11,93 % · rekomendacja wg zapisanej polityki
9,9
11,93 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.