Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,92 % · rekomendacja wg zapisanej polityki
openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowing…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.
When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
The firmware update process for the basemodule of the charging controller only validates the
CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.
This issue requires IKE to be enabled with an RSA-signature IKE policy to be…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application interprets the entered string of characters as a Java expression, allowing an unauthenticated attacer to perform arbitrary code…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Improper Authentication vulnerability in GE Vernova Smallworld on Windows, Linux allows Authentication Abuse.This issue affects Smallworld: 5.3.3 and prior versions for Linux, and 5.3.4. and prior versions for Windows.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, as well as overwrite existing files in that directory. An…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,92 % · rekomendacja wg zapisanej polityki
openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowing…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.
When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
The firmware update process for the basemodule of the charging controller only validates the
CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.
This issue requires IKE to be enabled with an RSA-signature IKE policy to be…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application interprets the entered string of characters as a Java expression, allowing an unauthenticated attacer to perform arbitrary code…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Improper Authentication vulnerability in GE Vernova Smallworld on Windows, Linux allows Authentication Abuse.This issue affects Smallworld: 5.3.3 and prior versions for Linux, and 5.3.4. and prior versions for Windows.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, as well as overwrite existing files in that directory. An…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki