Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product.
Successful exploitation could enable a malicious…
Opis źródłowy NVD · ENCVSS 9,4 · rekomendacja wg zapisanej polityki
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files.
This issue affects Elementor Pro: from n/a through 4.2.1.
Opis źródłowy NVD · ENCVSS 9,0 · EPSS 1,99 % · rekomendacja wg zapisanej polityki
Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions contain a path traversal vulnerability because user input is not properly sanitized.
This could allow a remote attacker to access arbitrary files on the device.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki
SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the id_video parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki
The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki
BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki
Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS version). If a remote attacker sends a specially crafted request to the product's web service, arbitrary code may be executed when the product is configured to run pop3wallpasswd…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,47 % · rekomendacja wg zapisanej polityki
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,47 % · rekomendacja wg zapisanej polityki
An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,47 % · rekomendacja wg zapisanej polityki
CVSS
9,3
EPSS
0,47 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product.
Successful exploitation could enable a malicious…
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files.
This issue affects Elementor Pro: from n/a through 4.2.1.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,0 · EPSS 1,99 % · rekomendacja wg zapisanej polityki
Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions contain a path traversal vulnerability because user input is not properly sanitized.
This could allow a remote attacker to access arbitrary files on the device.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki
SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the id_video parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki
The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki
BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki
Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS version). If a remote attacker sends a specially crafted request to the product's web service, arbitrary code may be executed when the product is configured to run pop3wallpasswd…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,47 % · rekomendacja wg zapisanej polityki
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,47 % · rekomendacja wg zapisanej polityki
An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,47 % · rekomendacja wg zapisanej polityki
9,3
0,47 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.