Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host and…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these…
Opis źródłowy NVD · ENalert CERT.pl · CVSS 9,3 · EPSS 0,1 % · rekomendacja wg zapisanej polityki
General Industrial Controls Lynx+ Gateway
is missing critical authentication in the embedded web server which could allow an attacker to remotely reset the device.
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,6 % · rekomendacja wg zapisanej polityki
A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,6 % · rekomendacja wg zapisanej polityki
boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root.
This issue was fixed in version 1.6.0: the…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,09 % · rekomendacja wg zapisanej polityki
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 1,08 % · rekomendacja wg zapisanej polityki
Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards non_interactive_mode as…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 1,07 % · rekomendacja wg zapisanej polityki
Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 1,07 % · rekomendacja wg zapisanej polityki
Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory.
This issue requires administrative privileges to abuse. On Windows systems, this scored as medium due to differences…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 1,07 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled.
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
CVSS
9,2
EPSS
0,57 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host and…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these…
Opis źródłowy NVD · EN
Pilne działanie
alert CERT.pl · CVSS 9,3 · EPSS 0,1 % · rekomendacja wg zapisanej polityki
General Industrial Controls Lynx+ Gateway
is missing critical authentication in the embedded web server which could allow an attacker to remotely reset the device.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,6 % · rekomendacja wg zapisanej polityki
A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,6 % · rekomendacja wg zapisanej polityki
boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root.
This issue was fixed in version 1.6.0: the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,09 % · rekomendacja wg zapisanej polityki
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 1,08 % · rekomendacja wg zapisanej polityki
Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards non_interactive_mode as…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 1,07 % · rekomendacja wg zapisanej polityki
Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 1,07 % · rekomendacja wg zapisanej polityki
Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory.
This issue requires administrative privileges to abuse. On Windows systems, this scored as medium due to differences…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 1,07 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
9,2
0,57 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.