Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the
child records are used immediately if not expired and thus valid, or the
records are expired, and in that case not…
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Mastodon is a free, open-source social network server based on ActivityPub. Versions 4.2.27 and prior, 4.3.0-beta.1 through 4.3.14, 4.4.0-beta.1 through 4.4.9, 4.5.0-beta.1 through 4.5.2 have discrepancies in error handling which allow checking whether a given status exists by sending a request…
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited…
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in…
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process.
This weakness can be exploited by an attacker to discover valid usernames within the system. The…
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct…
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected is the function sha1 of the file App/Home/Model/UserModel.class.php. The manipulation of the argument Password leads to password hash with…
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other…
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the
child records are used immediately if not expired and thus valid, or the
records are expired, and in that case not…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Mastodon is a free, open-source social network server based on ActivityPub. Versions 4.2.27 and prior, 4.3.0-beta.1 through 4.3.14, 4.4.0-beta.1 through 4.4.9, 4.5.0-beta.1 through 4.5.2 have discrepancies in error handling which allow checking whether a given status exists by sending a request…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an off-by-one error in…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process.
This weakness can be exploited by an attacker to discover valid usernames within the system. The…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected is the function sha1 of the file App/Home/Model/UserModel.class.php. The manipulation of the argument Password leads to password hash with…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,2 % · rekomendacja wg zapisanej polityki