Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through @rvf/core form…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service (stack exhaustion and process crash) via a DICOM dataset containing deeply nested sequences (SQ elements). The…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 - The “was this article helpful” voting widget posts a client-supplied ip field to its AJAX handlers (getDeny, getConfirm, getDenyReason in mod_djhelpful_articles/helper.php), reachable without…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member.…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Student Learning Assessment and Support System developed by JHENG GAO has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a specific page and obtain test accounts and password.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
CVSS
8,7
EPSS
0,39 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through @rvf/core form…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service (stack exhaustion and process crash) via a DICOM dataset containing deeply nested sequences (SQ elements). The…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 - The “was this article helpful” voting widget posts a client-supplied ip field to its AJAX handlers (getDeny, getConfirm, getDenyReason in mod_djhelpful_articles/helper.php), reachable without…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Student Learning Assessment and Support System developed by JHENG GAO has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a specific page and obtain test accounts and password.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
8,7
0,39 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.