Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verification of trusted reverse proxy origin. Attackers…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the component HTTP Request Handler. Performing a manipulation of the argument Profile results in stack-based buffer overflow. The attack is…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected element is the function sub_41AD7C of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of the component Web Management. The manipulation of the argument timestr/ntp_client_enabled results in stack-based buffer…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET§ion=ptest_channel of the component Web Management. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. The exploit…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/aspApBasicConfigUrcp of the component HTTP Handler. The manipulation of the argument pvid leads to stack-based buffer overflow. It is…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit a pathological decompression-bomb image to…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read,…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user. Low-privilege attackers can send their own user id with the tenant administrator roleId to escalate privileges or rebind…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verification of trusted reverse proxy origin. Attackers…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the component HTTP Request Handler. Performing a manipulation of the argument Profile results in stack-based buffer overflow. The attack is…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected element is the function sub_41AD7C of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of the component Web Management. The manipulation of the argument timestr/ntp_client_enabled results in stack-based buffer…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET§ion=ptest_channel of the component Web Management. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. The exploit…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/aspApBasicConfigUrcp of the component HTTP Handler. The manipulation of the argument pvid leads to stack-based buffer overflow. It is…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit a pathological decompression-bomb image to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user. Low-privilege attackers can send their own user id with the tenant administrator roleId to escalate privileges or rebind…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki