KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Document…
Przepełnienie bufora w KissFFT umożliwia zdalne wykonanie kodu przez atakujących.
Wyciek pamięci w daemonie DHCP Junos OS pozwala na zdalne wywołanie awarii usługi.
Twardo zakodowany klucz w Teamcenter umożliwia nieautoryzowany dostęp do aplikacji.
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts…
TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting…
Obejście uwierzytelnienia w OpenEMR pozwala na ominięcie wieloskładnikowego uwierzytelnienia.
Wstrzyknięcie SQL w EcclesiaCRM umożliwia atakującym manipulację danymi.
Inadequate access control vulnerability in Davantis DFUSION v6.177.7, which allows unauthorised actors to extract images and videos related to alarm events through access to “/alarms/<ALARM_ID>/<MEDIA>”, where the “MEDIA” parameter can take the value of “snapshot” or “video.mp4”. These media files…
Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass. This issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62 through EC 3.3b63 and from CW 3.3b24 through CW 3.3b25.
LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap…
EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN,…
Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT…
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards…
Błąd w Fulcio umożliwia atak SSRF i ujawnienie tokenów ServiceAccount przez nieprawidłowe przekierowania.
An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users. We recommend customers…
DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows.…
Luka XSS w AVideo pozwala administratorom na wstrzyknięcie złośliwych skryptów.
W AVideo występuje podatność XSS, umożliwiająca atakującym wykonanie działań administracyjnych.
VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the…
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid…
openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the…
Nieprawidłowa walidacja podpisów kryptograficznych w Pega Platform umożliwia obejście zabezpieczeń.
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the…
Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state or…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). | Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Document… |
Obserwuj | 8,7 | 0,29 % | ||
| Przepełnienie bufora w KissFFT umożliwia zdalne wykonanie kodu przez atakujących. | Przepełnienie bufora w KissFFT umożliwia zdalne wykonanie kodu przez atakujących. |
Obserwuj | 8,7 | 0,29 % | ||
| Wyciek pamięci w daemonie DHCP Junos OS pozwala na zdalne wywołanie awarii usługi. | Wyciek pamięci w daemonie DHCP Junos OS pozwala na zdalne wywołanie awarii usługi. |
Obserwuj | 8,7 | 0,29 % | ||
| Twardo zakodowany klucz w Teamcenter umożliwia nieautoryzowany dostęp do aplikacji. | Twardo zakodowany klucz w Teamcenter umożliwia nieautoryzowany dostęp do aplikacji. |
Obserwuj | 8,7 | 0,29 % | ||
| DataEase is an open source data visualization and analysis tool. | DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts… |
Obserwuj | 8,7 | 0,29 % | ||
| TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code… | TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting… |
Obserwuj | 8,6 | 0,79 % | ||
| Obejście uwierzytelnienia w OpenEMR pozwala na ominięcie wieloskładnikowego uwierzytelnienia. | Obejście uwierzytelnienia w OpenEMR pozwala na ominięcie wieloskładnikowego uwierzytelnienia. |
W tym tygodniu | 8,6 | 0,78 % | ||
| Wstrzyknięcie SQL w EcclesiaCRM umożliwia atakującym manipulację danymi. | Wstrzyknięcie SQL w EcclesiaCRM umożliwia atakującym manipulację danymi. |
Obserwuj | 8,7 | 0,29 % | ||
| Inadequate access control vulnerability in Davantis DFUSION v6.177.7, which allows unauthorised actors to extract images and videos… | Inadequate access control vulnerability in Davantis DFUSION v6.177.7, which allows unauthorised actors to extract images and videos related to alarm events through access to “/alarms/<ALARM_ID>/<MEDIA>”, where the “MEDIA” parameter can take the value of “snapshot” or “video.mp4”. These media files… |
Obserwuj | 8,7 | 0,29 % | ||
| Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows… | Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass. This issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62 through EC 3.3b63 and from CW 3.3b24 through CW 3.3b25. |
Obserwuj | 8,7 | 0,28 % | ||
| LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts… | LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap… |
Obserwuj | 8,7 | 0,28 % | ||
| EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because… | EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN,… |
Obserwuj | 8,7 | 0,28 % | ||
| Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored… | Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT… |
Obserwuj | 8,7 | 0,28 % | ||
| Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR… | Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards… |
Obserwuj | 8,7 | 0,28 % | ||
| Błąd w Fulcio umożliwia atak SSRF i ujawnienie tokenów ServiceAccount przez nieprawidłowe przekierowania. | Błąd w Fulcio umożliwia atak SSRF i ujawnienie tokenów ServiceAccount przez nieprawidłowe przekierowania. |
Obserwuj | 8,7 | 0,28 % | ||
| An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. | An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users. We recommend customers… |
Obserwuj | 8,6 | 0,78 % | ||
| DataEase is an open source data visualization and analysis tool. | DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows.… |
Obserwuj | 8,7 | 0,28 % | ||
| Luka XSS w AVideo pozwala administratorom na wstrzyknięcie złośliwych skryptów. | Luka XSS w AVideo pozwala administratorom na wstrzyknięcie złośliwych skryptów. |
Obserwuj | 8,7 | 0,28 % | ||
| W AVideo występuje podatność XSS, umożliwiająca atakującym wykonanie działań administracyjnych. | W AVideo występuje podatność XSS, umożliwiająca atakującym wykonanie działań administracyjnych. |
Obserwuj | 8,7 | 0,28 % | ||
| VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that… | VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the… |
Obserwuj | 8,7 | 0,28 % | ||
| GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by… | GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid… |
Obserwuj | 8,7 | 0,28 % | ||
| openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in… | openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the… |
Obserwuj | 8,6 | 0,78 % | ||
| Nieprawidłowa walidacja podpisów kryptograficznych w Pega Platform umożliwia obejście zabezpieczeń. | Nieprawidłowa walidacja podpisów kryptograficznych w Pega Platform umożliwia obejście zabezpieczeń. |
Obserwuj | 8,6 | 0,78 % | ||
| phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user… | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the… |
Obserwuj | 8,7 | 0,27 % | ||
| Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated… | Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state or… |
Obserwuj | 8,7 | 0,27 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.