Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy() to read…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting.
This issue affects WAH7601: through 20072026.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authenticated user to modify other participants’ votes in polls without authorization. The backend relies solely on the participantId parameter to…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability allows any authenticated user to change the display names of other participants in polls without being an admin or the poll owner. By manipulating the…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: QAS). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been published and may be used.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the import-csv REST API endpoint in all versions up to, and including, 2.3.1. This is due to the endpoint using `upload_files`…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
In multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy() to read…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting.
This issue affects WAH7601: through 20072026.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authenticated user to modify other participants’ votes in polls without authorization. The backend relies solely on the participantId parameter to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability allows any authenticated user to change the display names of other participants in polls without being an admin or the poll owner. By manipulating the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: QAS). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been published and may be used.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the import-csv REST API endpoint in all versions up to, and including, 2.3.1. This is due to the endpoint using `upload_files`…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
In multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki