KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Błąd w SiYuan umożliwia ujawnienie kluczy sesji i eskalację uprawnień do administratora.
Wykorzystanie podatności przejścia ścieżki w GitHub Enterprise Server pozwala na usunięcie dowolnych plików.
Wykrycie serwera w StoatChat umożliwia atakującym dostęp do wewnętrznych usług.
Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed…
Odczyt poza granicami bufora w jądrze Linuxa umożliwia atakującemu ujawnienie danych jądra.
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_config on /crawl requests. Attackers can supply a controlled page with include_external and include_patterns set, causing AsyncUrlSeeder to…
Twarde zakodowane dane logowania do bazy MySQL w Open ISES Tickets umożliwiają nieautoryzowany dostęp.
Obejście uwierzytelnienia w CyberPanel umożliwia zdalnym atakującym zapis dowolnych danych w bazie.
LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON() method (and subsequently when string-ifying objects using…
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI…
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to…
An authentication bypass security issue exists within FactoryTalk Historian Site Edition. By continually sending requests to the login endpoint, an attacker may obtain a valid authentication token.
Zdalne nadpisanie konfiguracji Gita w Weblate umożliwia zmianę jego zachowania.
The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This makes it possible…
SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments.
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments.
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.
Przepełnienie bufora w Wazuh umożliwia zdalne wykonanie kodu przez modyfikację ossec.conf.
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.
Weryfikacja podpisów JSON-LD w Misskey pozwala na akceptację sfałszowanych aktywności.
Luka RCE w StreamVault umożliwia zdalne wykonanie kodu przez nieprawidłową walidację argumentów.
The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied signup metadata with no realpath()…
A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Błąd w SiYuan umożliwia ujawnienie kluczy sesji i eskalację uprawnień do administratora. | Błąd w SiYuan umożliwia ujawnienie kluczy sesji i eskalację uprawnień do administratora. |
W tym tygodniu | 9,2 | 0,31 % | ||
| Wykorzystanie podatności przejścia ścieżki w GitHub Enterprise Server pozwala na usunięcie dowolnych plików. | Wykorzystanie podatności przejścia ścieżki w GitHub Enterprise Server pozwala na usunięcie dowolnych plików. |
W tym tygodniu | 9,1 | 0,8 % | ||
| Wykrycie serwera w StoatChat umożliwia atakującym dostęp do wewnętrznych usług. | Wykrycie serwera w StoatChat umożliwia atakującym dostęp do wewnętrznych usług. |
W tym tygodniu | 9,2 | 0,31 % | ||
| Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). | Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed… |
W tym tygodniu | 9,2 | 0,3 % | ||
| Odczyt poza granicami bufora w jądrze Linuxa umożliwia atakującemu ujawnienie danych jądra. | Odczyt poza granicami bufora w jądrze Linuxa umożliwia atakującemu ujawnienie danych jądra. |
W tym tygodniu | 9,1 | 0,8 % | ||
| Path traversal in server import and admin file upload in Crafty Controller. | Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution. |
Pilne działanie | 9,1 | 0,8 % | ||
| Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by… | Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_config on /crawl requests. Attackers can supply a controlled page with include_external and include_patterns set, causing AsyncUrlSeeder to… |
W tym tygodniu | 9,2 | 0,3 % | ||
| Twarde zakodowane dane logowania do bazy MySQL w Open ISES Tickets umożliwiają nieautoryzowany dostęp. | Twarde zakodowane dane logowania do bazy MySQL w Open ISES Tickets umożliwiają nieautoryzowany dostęp. |
W tym tygodniu | 9,2 | 0,3 % | ||
| Obejście uwierzytelnienia w CyberPanel umożliwia zdalnym atakującym zapis dowolnych danych w bazie. | Obejście uwierzytelnienia w CyberPanel umożliwia zdalnym atakującym zapis dowolnych danych w bazie. |
Pilne działanie | 9,1 | 0,79 % | ||
| LangChain is a framework for building LLM-powered applications. | LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON() method (and subsequently when string-ifying objects using… |
W tym tygodniu | 9,1 | 0,79 % | ||
| Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64… | Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI… |
W tym tygodniu | 9,2 | 0,29 % | ||
| Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s):… | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to… |
W tym tygodniu | 9,1 | 0,79 % | ||
| An authentication bypass security issue exists within FactoryTalk Historian Site Edition. By continually sending requests to the login… | An authentication bypass security issue exists within FactoryTalk Historian Site Edition. By continually sending requests to the login endpoint, an attacker may obtain a valid authentication token. |
W tym tygodniu | 9,2 | 0,29 % | ||
| Zdalne nadpisanie konfiguracji Gita w Weblate umożliwia zmianę jego zachowania. | Zdalne nadpisanie konfiguracji Gita w Weblate umożliwia zmianę jego zachowania. |
W tym tygodniu | 9,1 | 0,79 % | ||
| The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion… | The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This makes it possible… |
W tym tygodniu | 9,1 | 0,79 % | ||
| SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code… | SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments. |
W tym tygodniu | 9,1 | 0,79 % | ||
| SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments. |
W tym tygodniu | 9,1 | 0,79 % | ||
| SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments. |
W tym tygodniu | 9,1 | 0,79 % | ||
| SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote… | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments. |
W tym tygodniu | 9,1 | 0,79 % | ||
| Przepełnienie bufora w Wazuh umożliwia zdalne wykonanie kodu przez modyfikację ossec.conf. | Przepełnienie bufora w Wazuh umożliwia zdalne wykonanie kodu przez modyfikację ossec.conf. |
Pilne działanie | 9,1 | 0,78 % | ||
| Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). | Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue. |
W tym tygodniu | 9,1 | 0,78 % | ||
| Weryfikacja podpisów JSON-LD w Misskey pozwala na akceptację sfałszowanych aktywności. | Weryfikacja podpisów JSON-LD w Misskey pozwala na akceptację sfałszowanych aktywności. |
W tym tygodniu | 9,2 | 0,28 % | ||
| Luka RCE w StreamVault umożliwia zdalne wykonanie kodu przez nieprawidłową walidację argumentów. | Luka RCE w StreamVault umożliwia zdalne wykonanie kodu przez nieprawidłową walidację argumentów. |
Pilne działanie | 9,1 | 0,78 % | ||
| The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including,… | The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied signup metadata with no realpath()… |
W tym tygodniu | 9,1 | 0,78 % | ||
| A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the… | A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule… |
W tym tygodniu | 9,1 | 0,78 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.