Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService,…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/* paths for .jpg, .png, .bmp, or .mp4 files, which are…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold() that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHelpForPage, GetRemoteDashboardContent, and…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement restrictions on SSH port forwarding, allowing to connect to arbitrary destinations. When SSH is enabled on an affected product, SSH port forwarding may be leveraged to connect to other node on the LAN.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.translation.get_supported_language_variant()` is subject to
a potential denial-of-service attack when processing many distinct, very long
language codes, which are retained as keys in an…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.http.parse_header_parameters()` was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses to be accepted by manipulating the email field in the /api/method/press.api.account.signup endpoint. The vulnerability occurs when an…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
CVSS
6,9
EPSS
0,38 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/* paths for .jpg, .png, .bmp, or .mp4 files, which are…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold() that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHelpForPage, GetRemoteDashboardContent, and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement restrictions on SSH port forwarding, allowing to connect to arbitrary destinations. When SSH is enabled on an affected product, SSH port forwarding may be leveraged to connect to other node on the LAN.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.translation.get_supported_language_variant()` is subject to
a potential denial-of-service attack when processing many distinct, very long
language codes, which are retained as keys in an…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.http.parse_header_parameters()` was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses to be accepted by manipulating the email field in the /api/method/press.api.account.signup endpoint. The vulnerability occurs when an…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
6,9
0,38 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.