Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
minaliC 2.0.0 contains a denial of service vulnerability that allows remote attackers to crash the web server by sending oversized GET requests. Attackers can send crafted HTTP requests with excessive data to overwhelm the server and cause service interruption.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames.
do_read_data/5 in lib/bandit/http2/stream.ex keeps every…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames, max_tokens_per_frame and max_image_tokens in the video_url object. Attackers can set these values arbitrarily high so glm4v.py…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to size an allocation (np.random.randint(size=(total_samples, channels))). A ~50-byte crafted FLAC file declaring ~100 million samples causes a…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element()…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
minaliC 2.0.0 contains a denial of service vulnerability that allows remote attackers to crash the web server by sending oversized GET requests. Attackers can send crafted HTTP requests with excessive data to overwhelm the server and cause service interruption.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames.
do_read_data/5 in lib/bandit/http2/stream.ex keeps every…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames, max_tokens_per_frame and max_image_tokens in the video_url object. Attackers can set these values arbitrarily high so glm4v.py…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to size an allocation (np.random.randint(size=(total_samples, channels))). A ~50-byte crafted FLAC file declaring ~100 million samples causes a…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element()…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,49 % · rekomendacja wg zapisanej polityki