Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
A denial of service security issue exists in the
affected product. The security issue stems from a fault occurring when a
crafted CIP message is sent. Devices with less memory are more likely to be
affected. This can result in a major nonrecoverable fault (MNRF). A program
download is required to…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, which makes the bounds check that…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This was…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
A denial of service security issue exists in the
affected product. The security issue stems from a fault occurring when a
crafted CIP message is sent. Devices with less memory are more likely to be
affected. This can result in a major nonrecoverable fault (MNRF). A program
download is required to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, which makes the bounds check that…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This was…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki