Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file'…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,54 % · rekomendacja wg zapisanej polityki
SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,54 % · rekomendacja wg zapisanej polityki
SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,53 % · rekomendacja wg zapisanej polityki
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,53 % · rekomendacja wg zapisanej polityki
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse.
esaml_binding:decode_response/2 parses the decoded SAMLResponse with…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,53 % · rekomendacja wg zapisanej polityki
The authentication middleware of the JTL-Shop
administration backend processes the plugin safe mode toggle on the admin
logout route before checking whether the requesting user is
authenticated. An unauthenticated remote attacker can therefore switch the shop's
plugin safe mode on and off, which…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,53 % · rekomendacja wg zapisanej polityki
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file'…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,54 % · rekomendacja wg zapisanej polityki
SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,54 % · rekomendacja wg zapisanej polityki
SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,53 % · rekomendacja wg zapisanej polityki
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,53 % · rekomendacja wg zapisanej polityki
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse.
esaml_binding:decode_response/2 parses the decoded SAMLResponse with…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,53 % · rekomendacja wg zapisanej polityki
The authentication middleware of the JTL-Shop
administration backend processes the plugin safe mode toggle on the admin
logout route before checking whether the requesting user is
authenticated. An unauthenticated remote attacker can therefore switch the shop's
plugin safe mode on and off, which…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,53 % · rekomendacja wg zapisanej polityki