Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages.
expand_repositories_scope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks.
Hex prints strings supplied by the package repository and the…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are not authorized to see.
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beam_mcp allows an MCP client's JSON true, false and null tool arguments to reach the host's dispatch function as the strings "true", "false" and "nil". After BeamMCP.Schema.validate/2 accepted a value as a boolean,…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery (SSRF) guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-authorization-server of the component OAuth Server Discovery. Such manipulation of the argument authorizationUrl leads to os command…
Opis źródłowy NVD · ENCVSS 2,1 · EPSS 1,32 % · rekomendacja wg zapisanej polityki
An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and then allowing pip to consult the configured index, bypassing virtualenv's download_wheel() and…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses…
Opis źródłowy NVD · ENCVSS 2,3 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages.
expand_repositories_scope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks.
Hex prints strings supplied by the package repository and the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are not authorized to see.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beam_mcp allows an MCP client's JSON true, false and null tool arguments to reach the host's dispatch function as the strings "true", "false" and "nil". After BeamMCP.Schema.validate/2 accepted a value as a boolean,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery (SSRF) guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-authorization-server of the component OAuth Server Discovery. Such manipulation of the argument authorizationUrl leads to os command…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,1 · EPSS 1,32 % · rekomendacja wg zapisanej polityki
An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and then allowing pip to consult the configured index, bypassing virtualenv's download_wheel() and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,3 · EPSS 0,29 % · rekomendacja wg zapisanej polityki