KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLove Extension allows Stored XSS.This issue affects Mediawiki - WikiLove Extension: 1.39.
Błąd w bibliotece ip-address pozwala na obejście filtrów SSRF, traktując wewnętrzne adresy jako zewnętrzne.
Nieautoryzowane usunięcie powiadomień w systemie umożliwia atakującemu usunięcie powiadomień innych użytkowników.
Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validates…
In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object…
CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java blocks the RFC 6052 64:ff9b::/96 NAT64 prefix but omits the…
Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled (graphQLPublicIntrospection: false, the default), schema-derived 'Did you mean ...?' suggestions were still…
SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/import endpoint. Attackers can supply non-numeric input-dimensions or other…
Podatność w SurrealDB umożliwia atakującym zablokowanie serwera przez nieprawidłowe role użytkowników.
The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses after DNS resolution. IPv6 transition addresses (NAT64 `64:ff9b::/96`, 6to4 `2002::/16`, Teredo `2001:0000::/32`) are classified as globally routable by IANA, so `is_global` returns…
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities.
NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve…
Wstrzyknięcie poleceń w NVIDIA UFM Enterprise umożliwia zdalne wykonanie kodu przez atakującego.
Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordings_path via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending…
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager, retain session entries without…
Błąd w Blueprint Studio umożliwia przechowywanie tokenów Git w pliku tekstowym, co naraża je na odczyt przez inne procesy.
Przepełnienie bufora w IEC 60870-5-104 umożliwia zdalne wykonanie kodu.
Przepełnienie bufora w IEC 60870-5-104 umożliwia zdalne wykonanie kodu.
NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed…
A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to user enumeration due to distinguishable responses. This could allow an unauthenticated remote attacker to determine if a user is valid or not, enabling a brute force attack…
Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions.
A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device Kit - arm64 V1.11, Industrial Edge Device Kit - arm64 V1.12, Industrial Edge Device Kit - arm64 V1.13, Industrial Edge Device Kit - arm64 V1.14, Industrial…
Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and…
Brak restrykcji przy tworzeniu kont w StoaChat pozwala na tworzenie nieograniczonej liczby kont.
Wstrzyknięcie poleceń w D-Link DCS-933L umożliwia zdalne wykonanie kodu.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation… | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLove Extension allows Stored XSS.This issue affects Mediawiki - WikiLove Extension: 1.39. |
Do wiadomości | 6,9 | 0,48 % | ||
| Błąd w bibliotece ip-address pozwala na obejście filtrów SSRF, traktując wewnętrzne adresy jako zewnętrzne. | Błąd w bibliotece ip-address pozwala na obejście filtrów SSRF, traktując wewnętrzne adresy jako zewnętrzne. |
Do wiadomości | 6,9 | 0,48 % | ||
| Nieautoryzowane usunięcie powiadomień w systemie umożliwia atakującemu usunięcie powiadomień innych użytkowników. | Nieautoryzowane usunięcie powiadomień w systemie umożliwia atakującemu usunięcie powiadomień innych użytkowników. |
Do wiadomości | 6,9 | 0,48 % | ||
| Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set… | Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validates… |
Do wiadomości | 6,9 | 0,48 % | ||
| In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. | In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object… |
Do wiadomości | 6,9 | 0,48 % | ||
| CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. | CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java blocks the RFC 6052 64:ff9b::/96 NAT64 prefix but omits the… |
Do wiadomości | 6,9 | 0,47 % | ||
| Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. | Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled (graphQLPublicIntrospection: false, the default), schema-derived 'Did you mean ...?' suggestions were still… |
Do wiadomości | 6,9 | 0,47 % | ||
| SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated… | SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/import endpoint. Attackers can supply non-numeric input-dimensions or other… |
Do wiadomości | 6,9 | 0,47 % | ||
| Podatność w SurrealDB umożliwia atakującym zablokowanie serwera przez nieprawidłowe role użytkowników. | Podatność w SurrealDB umożliwia atakującym zablokowanie serwera przez nieprawidłowe role użytkowników. |
Do wiadomości | 6,9 | 0,47 % | ||
| The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses after DNS resolution.… | The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses after DNS resolution. IPv6 transition addresses (NAT64 `64:ff9b::/96`, 6to4 `2002::/16`, Teredo `2001:0000::/32`) are classified as globally routable by IANA, so `is_global` returns… |
Do wiadomości | 6,9 | 0,47 % | ||
| Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and… | Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities. |
Do wiadomości | 6,9 | 0,47 % | ||
| NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction… | NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve… |
Do wiadomości | 6,9 | 0,46 % | ||
| Wstrzyknięcie poleceń w NVIDIA UFM Enterprise umożliwia zdalne wykonanie kodu przez atakującego. | Wstrzyknięcie poleceń w NVIDIA UFM Enterprise umożliwia zdalne wykonanie kodu przez atakującego. |
Do wiadomości | 6,8 | 0,97 % | ||
| Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers… | Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordings_path via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending… |
Do wiadomości | 6,9 | 0,46 % | ||
| The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). | The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager, retain session entries without… |
Do wiadomości | 6,9 | 0,46 % | ||
| Błąd w Blueprint Studio umożliwia przechowywanie tokenów Git w pliku tekstowym, co naraża je na odczyt przez inne procesy. | Błąd w Blueprint Studio umożliwia przechowywanie tokenów Git w pliku tekstowym, co naraża je na odczyt przez inne procesy. |
Do wiadomości | 6,9 | 0,46 % | ||
| Przepełnienie bufora w IEC 60870-5-104 umożliwia zdalne wykonanie kodu. | Przepełnienie bufora w IEC 60870-5-104 umożliwia zdalne wykonanie kodu. |
Do wiadomości | 6,9 | 0,46 % | ||
| Przepełnienie bufora w IEC 60870-5-104 umożliwia zdalne wykonanie kodu. | Przepełnienie bufora w IEC 60870-5-104 umożliwia zdalne wykonanie kodu. |
Do wiadomości | 6,9 | 0,46 % | ||
| NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated… | NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed… |
Do wiadomości | 6,9 | 0,46 % | ||
| A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). | A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to user enumeration due to distinguishable responses. This could allow an unauthenticated remote attacker to determine if a user is valid or not, enabling a brute force attack… |
Do wiadomości | 6,9 | 0,46 % | ||
| Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5 - The front-end Submissions view did… | Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions. |
Do wiadomości | 6,9 | 0,45 % | ||
| A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge… | A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device Kit - arm64 V1.11, Industrial Edge Device Kit - arm64 V1.12, Industrial Edge Device Kit - arm64 V1.13, Industrial Edge Device Kit - arm64 V1.14, Industrial… |
Do wiadomości | 6,9 | 0,45 % | ||
| Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client… | Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and… |
Do wiadomości | 6,9 | 0,45 % | ||
| Brak restrykcji przy tworzeniu kont w StoaChat pozwala na tworzenie nieograniczonej liczby kont. | Brak restrykcji przy tworzeniu kont w StoaChat pozwala na tworzenie nieograniczonej liczby kont. |
Do wiadomości | 6,9 | 0,45 % | ||
| Wstrzyknięcie poleceń w D-Link DCS-933L umożliwia zdalne wykonanie kodu. | Wstrzyknięcie poleceń w D-Link DCS-933L umożliwia zdalne wykonanie kodu. |
Do wiadomości | 6,3 | 3,45 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.