Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to run arbitrary commands via the user interface. This user interface can be used via the network and allows the execution of commands as administrative application…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render(),…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,92 % · rekomendacja wg zapisanej polityki
Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` passes the raw `Accept-Language` header from `LanguageMiddlewareFunc` through `GetLanguagePreference` to `golang.org/x/text/language.ParseAcceptLanguage` without a size or shape…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the before_html field through the contact form edit endpoint, which lacks proper…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
An incorrect authorization vulnerability in the WinBox
authentication flow of MikroTik RouterOS allows a remote authenticated attacker
with credentials for a low-privilege account permitted to use WinBox to obtain
the authorization policy of a different existing account. The stage-one…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected because its data representation has incorrect endianness. The session and its AR remain allocated, so repeated requests exhaust the available sessions. Once they are exhausted…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to aspose_doc_exporter_download.php with the 'file' parameter…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations.
Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
An unauthenticated remote attacker is able to exhaust all available TCP connections in the CODESYS EtherNet/IP adapter stack, preventing legitimate clients from establishing new connections.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config property in backend/src/Entity/Station.php is annotated with GROUP_GENERAL, and PUT /api/station/{station_id}/profile/edit in…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
CVSS
8,7
EPSS
0,41 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to run arbitrary commands via the user interface. This user interface can be used via the network and allows the execution of commands as administrative application…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render(),…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,92 % · rekomendacja wg zapisanej polityki
Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` passes the raw `Accept-Language` header from `LanguageMiddlewareFunc` through `GetLanguagePreference` to `golang.org/x/text/language.ParseAcceptLanguage` without a size or shape…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the before_html field through the contact form edit endpoint, which lacks proper…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
An incorrect authorization vulnerability in the WinBox
authentication flow of MikroTik RouterOS allows a remote authenticated attacker
with credentials for a low-privilege account permitted to use WinBox to obtain
the authorization policy of a different existing account. The stage-one…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected because its data representation has incorrect endianness. The session and its AR remain allocated, so repeated requests exhaust the available sessions. Once they are exhausted…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to aspose_doc_exporter_download.php with the 'file' parameter…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations.
Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
An unauthenticated remote attacker is able to exhaust all available TCP connections in the CODESYS EtherNet/IP adapter stack, preventing legitimate clients from establishing new connections.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config property in backend/src/Entity/Station.php is annotated with GROUP_GENERAL, and PUT /api/station/{station_id}/profile/edit in…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
8,7
0,41 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.