Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown(). While a small set of Markdown metacharacters are escaped, characters such as < and > are preserved,…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,63 % · rekomendacja wg zapisanej polityki
The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to access and modify critical device settings.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,63 % · rekomendacja wg zapisanej polityki
A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,63 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,62 % · rekomendacja wg zapisanej polityki
A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter. This manipulation of the argument newap_text_%d causes stack-based buffer overflow. The attack may be initiated…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,62 % · rekomendacja wg zapisanej polityki
Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,62 % · rekomendacja wg zapisanej polityki
The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,62 % · rekomendacja wg zapisanej polityki
CVSS
9,3
EPSS
0,62 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown(). While a small set of Markdown metacharacters are escaped, characters such as < and > are preserved,…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,63 % · rekomendacja wg zapisanej polityki
The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to access and modify critical device settings.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,63 % · rekomendacja wg zapisanej polityki
A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,63 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,62 % · rekomendacja wg zapisanej polityki
A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter. This manipulation of the argument newap_text_%d causes stack-based buffer overflow. The attack may be initiated…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,62 % · rekomendacja wg zapisanej polityki
Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,62 % · rekomendacja wg zapisanej polityki
The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,62 % · rekomendacja wg zapisanej polityki
9,3
0,62 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.