Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint.
Successful exploitation…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.126.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and below, a single crafted deep link can silently hijack all GPS tracking parameters and redirect telemetry to an attacker-controlled server. The…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the '
Security…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection.…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 1,32 % · rekomendacja wg zapisanej polityki
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel() check.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
CVSS
9,3
EPSS
0,31 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint.
Successful exploitation…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.126.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and below, a single crafted deep link can silently hijack all GPS tracking parameters and redirect telemetry to an attacker-controlled server. The…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the '
Security…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection.…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 1,32 % · rekomendacja wg zapisanej polityki
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel() check.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
9,3
0,31 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.