Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
WWBN AVideo is an open source video platform. In versions up to and including 29.0, an incomplete fix for AVideo's `test.php` adds `escapeshellarg` for wget but leaves the `file_get_contents` and `curl` code paths unsanitized, and the URL validation regex `/^http/` accepts strings like…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
WWBN AVideo is an open source video platform. In versions up to and including 29.0, an incomplete fix for AVideo's `test.php` adds `escapeshellarg` for wget but leaves the `file_get_contents` and `curl` code paths unsanitized, and the URL validation regex `/^http/` accepts strings like…
Opis źródłowy NVD · EN
Pilne działanie
CVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki