KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind SQL Injection.This issue affects EduAdmin Booking: from n/a before 6.0.0.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdreams Ajax Search Pro ajax-search-pro allows Blind SQL Injection.This issue affects Ajax Search Pro: from n/a through 4.29.1.
Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code.
Brak ograniczeń w Grav API pozwala na edytowanie pól uprawnień przez użytkowników z kluczem API.
In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.
Wstrzyknięcie SQL w GeoDirectory umożliwia nieautoryzowany dostęp do bazy danych.
Wstrzyknięcie SQL w VikAppointments umożliwia nieautoryzowany dostęp do danych.
Wstrzyknięcie SQL w WP Directory Kit umożliwia przeprowadzenie ataku typu Blind SQL Injection.
The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network.
A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted TCP packet when key-chain authentication is used for BGP or LDP.
openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.
Wstrzyknięcie SQL w Zeon Academy Pro umożliwia atakującemu manipulację bazą danych.
Nieprawidłowa walidacja certyfikatów w FreeRDP osłabia uwierzytelnianie serwera TLS.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.
Wstrzyknięcie SQL w RealMag777 TableOn umożliwia przeprowadzenie ataku typu Blind SQL Injection.
Nieprawidłowe zarządzanie ciasteczkami w Lightpanda umożliwia atakującym wykonywanie uwierzytelnionych żądań cross-origin.
Wstrzyknięcie SQL w VillaTheme GIFT4U umożliwia przeprowadzenie ataku typu Blind SQL Injection.
Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.
A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and…
A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind SQL Injection.This issue affects EduAdmin Booking: from n/a before 6.0.0. |
W tym tygodniu | 9,3 | 0,24 % | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdreams Ajax Search Pro… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdreams Ajax Search Pro ajax-search-pro allows Blind SQL Injection.This issue affects Ajax Search Pro: from n/a through 4.29.1. |
W tym tygodniu | 9,3 | 0,24 % | ||
| Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to… | Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code. |
W tym tygodniu | 9,3 | 0,24 % | ||
| Brak ograniczeń w Grav API pozwala na edytowanie pól uprawnień przez użytkowników z kluczem API. | Brak ograniczeń w Grav API pozwala na edytowanie pól uprawnień przez użytkowników z kluczem API. |
W tym tygodniu | 9,3 | 0,24 % | ||
| In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. | In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity. |
W tym tygodniu | 9,3 | 0,24 % | ||
| Wstrzyknięcie SQL w GeoDirectory umożliwia nieautoryzowany dostęp do bazy danych. | Wstrzyknięcie SQL w GeoDirectory umożliwia nieautoryzowany dostęp do bazy danych. |
W tym tygodniu | 9,3 | 0,24 % | ||
| Wstrzyknięcie SQL w VikAppointments umożliwia nieautoryzowany dostęp do danych. | Wstrzyknięcie SQL w VikAppointments umożliwia nieautoryzowany dostęp do danych. |
W tym tygodniu | 9,3 | 0,24 % | ||
| Wstrzyknięcie SQL w WP Directory Kit umożliwia przeprowadzenie ataku typu Blind SQL Injection. | Wstrzyknięcie SQL w WP Directory Kit umożliwia przeprowadzenie ataku typu Blind SQL Injection. |
W tym tygodniu | 9,3 | 0,24 % | ||
| The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is… | The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network. |
W tym tygodniu | 9,3 | 0,24 % | ||
| A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker… | A Stack-based Buffer Overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted TCP packet when key-chain authentication is used for BGP or LDP. |
W tym tygodniu | 9,2 | 0,74 % | ||
| openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and… | openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password. |
W tym tygodniu | 9,3 | 0,24 % | ||
| Wstrzyknięcie SQL w Zeon Academy Pro umożliwia atakującemu manipulację bazą danych. | Wstrzyknięcie SQL w Zeon Academy Pro umożliwia atakującemu manipulację bazą danych. |
W tym tygodniu | 9,3 | 0,24 % | ||
| Nieprawidłowa walidacja certyfikatów w FreeRDP osłabia uwierzytelnianie serwera TLS. | Nieprawidłowa walidacja certyfikatów w FreeRDP osłabia uwierzytelnianie serwera TLS. |
Pilne działanie | 9,3 | 0,24 % | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite DXP ToolKit… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1. |
W tym tygodniu | 9,3 | 0,24 % | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29. |
W tym tygodniu | 9,3 | 0,24 % | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3. |
W tym tygodniu | 9,3 | 0,24 % | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7. |
W tym tygodniu | 9,3 | 0,24 % | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10. |
W tym tygodniu | 9,3 | 0,24 % | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9. |
W tym tygodniu | 9,3 | 0,24 % | ||
| Wstrzyknięcie SQL w RealMag777 TableOn umożliwia przeprowadzenie ataku typu Blind SQL Injection. | Wstrzyknięcie SQL w RealMag777 TableOn umożliwia przeprowadzenie ataku typu Blind SQL Injection. |
W tym tygodniu | 9,3 | 0,24 % | ||
| Nieprawidłowe zarządzanie ciasteczkami w Lightpanda umożliwia atakującym wykonywanie uwierzytelnionych żądań cross-origin. | Nieprawidłowe zarządzanie ciasteczkami w Lightpanda umożliwia atakującym wykonywanie uwierzytelnionych żądań cross-origin. |
W tym tygodniu | 9,3 | 0,23 % | ||
| Wstrzyknięcie SQL w VillaTheme GIFT4U umożliwia przeprowadzenie ataku typu Blind SQL Injection. | Wstrzyknięcie SQL w VillaTheme GIFT4U umożliwia przeprowadzenie ataku typu Blind SQL Injection. |
W tym tygodniu | 9,3 | 0,23 % | ||
| Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. | Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. |
W tym tygodniu | 9,3 | 0,23 % | ||
| A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to… | A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and… |
W tym tygodniu | 9,3 | 0,23 % | ||
| A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker… | A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access… |
W tym tygodniu | 9,3 | 0,23 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.