KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Wykryto podatność w GoClaw, umożliwiającą zdalne ataki typu server-side request forgery.
A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and…
A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 is…
Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\…
A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Extra-Networks Card Builder. Such manipulation of the argument…
A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file modules/ui_extra_networks.py of the component Card Builder. The manipulation of the argument filename leads to cross site scripting. It is possible to…
Manipulacja w json-schema-library pozwala na zdalną modyfikację atrybutów prototypu obiektu.
Manipulacja prototypem obiektów w Tamagui umożliwia zdalne ataki.
A vulnerability was determined in kofrasa mingo up to 7.2.1. This impacts the function update/updateOne/updateMany of the component Update API. Executing a manipulation of the argument Set can lead to improperly controlled modification of object prototype attributes. The attack may be launched…
Przepełnienie bufora w Open Asset Import Library umożliwia zdalne wykonanie kodu.
Przepełnienie bufora w Open Asset Import Library umożliwia zdalne wykonanie kodu.
A security flaw has been discovered in zhayujie CowAgent up to 2.2.0. This affects an unknown part of the file Markdown.tsx of the component Markdown Rendering. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit has been released to the public…
A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly…
A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channel/web/web_channel.py of the component Web Console. The manipulation of the argument session_id results in denial of service. The attack may be performed from remote. The exploit…
A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX. This vulnerability affects unknown code of the file /authorize of the component HTTP Request Handler. Executing a manipulation of the argument Success can lead to http response splitting. It is possible to launch the attack…
Podatność w Webkul Bagisto umożliwia zdalne wykonanie ataku XSS przez rejestrację klienta.
Podatność w Alaev SEO Tools Extension umożliwia zdalne wykonanie ataku XSS.
Wykorzystanie luki w OBlog umożliwia zdalne wykonanie ataku XSS.
Wstrzyknięcie skryptów w igweze wizgrade umożliwia atak zdalny.
A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element is the function DocController.doGetTmp of the file /Doc/doGetTmpFile.do of the component Document Controller. The manipulation of the argument path/fileName leads to path traversal. Remote…
Manipulacja w zhinianboke xianyu-auto-reply pozwala na zdalne wykorzystanie nieautoryzowanych metod HTTP.
Manipulacja w svg.js pozwala na niekontrolowaną modyfikację atrybutów prototypu obiektu.
A vulnerability was identified in spencermountain compromise up to 14.15.1. Affected is the function nlp.extend of the file src/API/extend.js of the component Public Root API. The manipulation of the argument plugin leads to improperly controlled modification of object prototype attributes. Remote…
A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. The exploit is now public and…
A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the component Crm Endpoint. Such manipulation of the argument redirect_url leads to cross site scripting. The…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Wykryto podatność w GoClaw, umożliwiającą zdalne ataki typu server-side request forgery. | Wykryto podatność w GoClaw, umożliwiającą zdalne ataki typu server-side request forgery. |
Do wiadomości | 2,1 | 0,46 % | ||
| A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. | A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and… |
Do wiadomości | 2,1 | 0,46 % | ||
| A flaw has been found in francoisjacquet RosarioSIS up to 12.8. | A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 is… |
Do wiadomości | 2,1 | 0,46 % | ||
| Astro is a web framework for content-driven websites. | Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\… |
Do wiadomości | 2,1 | 0,46 % | ||
| A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. | A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Extra-Networks Card Builder. Such manipulation of the argument… |
Do wiadomości | 2,1 | 0,46 % | ||
| A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. | A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file modules/ui_extra_networks.py of the component Card Builder. The manipulation of the argument filename leads to cross site scripting. It is possible to… |
Do wiadomości | 2,1 | 0,46 % | ||
| Manipulacja w json-schema-library pozwala na zdalną modyfikację atrybutów prototypu obiektu. | Manipulacja w json-schema-library pozwala na zdalną modyfikację atrybutów prototypu obiektu. |
Do wiadomości | 2,1 | 0,46 % | ||
| Manipulacja prototypem obiektów w Tamagui umożliwia zdalne ataki. | Manipulacja prototypem obiektów w Tamagui umożliwia zdalne ataki. |
Do wiadomości | 2,1 | 0,46 % | ||
| A vulnerability was determined in kofrasa mingo up to 7.2.1. | A vulnerability was determined in kofrasa mingo up to 7.2.1. This impacts the function update/updateOne/updateMany of the component Update API. Executing a manipulation of the argument Set can lead to improperly controlled modification of object prototype attributes. The attack may be launched… |
Do wiadomości | 2,1 | 0,46 % | ||
| Przepełnienie bufora w Open Asset Import Library umożliwia zdalne wykonanie kodu. | Przepełnienie bufora w Open Asset Import Library umożliwia zdalne wykonanie kodu. |
Do wiadomości | 2,1 | 0,45 % | ||
| Przepełnienie bufora w Open Asset Import Library umożliwia zdalne wykonanie kodu. | Przepełnienie bufora w Open Asset Import Library umożliwia zdalne wykonanie kodu. |
Do wiadomości | 2,1 | 0,45 % | ||
| A security flaw has been discovered in zhayujie CowAgent up to 2.2.0. | A security flaw has been discovered in zhayujie CowAgent up to 2.2.0. This affects an unknown part of the file Markdown.tsx of the component Markdown Rendering. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit has been released to the public… |
Do wiadomości | 2,1 | 0,45 % | ||
| A vulnerability was identified in zhayujie CowAgent up to 2.2.0. | A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly… |
Do wiadomości | 2,1 | 0,45 % | ||
| A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. | A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channel/web/web_channel.py of the component Web Console. The manipulation of the argument session_id results in denial of service. The attack may be performed from remote. The exploit… |
Do wiadomości | 2,1 | 0,45 % | ||
| A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX. | A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX. This vulnerability affects unknown code of the file /authorize of the component HTTP Request Handler. Executing a manipulation of the argument Success can lead to http response splitting. It is possible to launch the attack… |
Do wiadomości | 2,1 | 0,45 % | ||
| Podatność w Webkul Bagisto umożliwia zdalne wykonanie ataku XSS przez rejestrację klienta. | Podatność w Webkul Bagisto umożliwia zdalne wykonanie ataku XSS przez rejestrację klienta. |
Do wiadomości | 2,1 | 0,45 % | ||
| Podatność w Alaev SEO Tools Extension umożliwia zdalne wykonanie ataku XSS. | Podatność w Alaev SEO Tools Extension umożliwia zdalne wykonanie ataku XSS. |
Do wiadomości | 2,1 | 0,45 % | ||
| Wykorzystanie luki w OBlog umożliwia zdalne wykonanie ataku XSS. | Wykorzystanie luki w OBlog umożliwia zdalne wykonanie ataku XSS. |
Do wiadomości | 2,1 | 0,45 % | ||
| Wstrzyknięcie skryptów w igweze wizgrade umożliwia atak zdalny. | Wstrzyknięcie skryptów w igweze wizgrade umożliwia atak zdalny. |
Do wiadomości | 2,1 | 0,45 % | ||
| A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. | A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element is the function DocController.doGetTmp of the file /Doc/doGetTmpFile.do of the component Document Controller. The manipulation of the argument path/fileName leads to path traversal. Remote… |
Do wiadomości | 2,1 | 0,45 % | ||
| Manipulacja w zhinianboke xianyu-auto-reply pozwala na zdalne wykorzystanie nieautoryzowanych metod HTTP. | Manipulacja w zhinianboke xianyu-auto-reply pozwala na zdalne wykorzystanie nieautoryzowanych metod HTTP. |
Do wiadomości | 2,1 | 0,45 % | ||
| Manipulacja w svg.js pozwala na niekontrolowaną modyfikację atrybutów prototypu obiektu. | Manipulacja w svg.js pozwala na niekontrolowaną modyfikację atrybutów prototypu obiektu. |
Do wiadomości | 2,1 | 0,45 % | ||
| A vulnerability was identified in spencermountain compromise up to 14.15.1. | A vulnerability was identified in spencermountain compromise up to 14.15.1. Affected is the function nlp.extend of the file src/API/extend.js of the component Public Root API. The manipulation of the argument plugin leads to improperly controlled modification of object prototype attributes. Remote… |
Do wiadomości | 2,1 | 0,45 % | ||
| A vulnerability was detected in D-Link E15, M32, R15 and R32. | A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. The exploit is now public and… |
Do wiadomości | 2,1 | 0,44 % | ||
| A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. | A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the component Crm Endpoint. Such manipulation of the argument redirect_url leads to cross site scripting. The… |
Do wiadomości | 2,1 | 0,44 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.