Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to version…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Connection desynchronization between an HTTP proxy and the model backend. The fixes were rolled out for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validate_url checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an unvalidated provider base_url. Attackers can set base_url via the provider config endpoint and trigger POST /api/v1/models/check to…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Description
NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSC#get. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host,…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate availability even when an administrator…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
The WP User Manager plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 2.9.12. This is due to insufficient validation of user-supplied file paths in the profile update functionality combined with improper handling of array inputs by PHP's…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,82 % · rekomendacja wg zapisanej polityki
Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server Script execution when one server script triggers another. Authenticated high-privileged users can craft a Server Script that triggers other server…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint. Attackers can send arbitrarily large or concurrent request bodies to POST /api/v1/sns/{tenant}/{event} with any UUID,…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
FutureNet MA and IP-K series provided by Century Systems Co., Ltd. put the firmware version and the garbage collection information on the internal web page. With some crafted HTTP request, they can be accessed without authentication.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
CVSS
6,9
EPSS
0,32 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to version…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Connection desynchronization between an HTTP proxy and the model backend. The fixes were rolled out for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validate_url checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an unvalidated provider base_url. Attackers can set base_url via the provider config endpoint and trigger POST /api/v1/models/check to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Description
NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSC#get. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate availability even when an administrator…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
The WP User Manager plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 2.9.12. This is due to insufficient validation of user-supplied file paths in the profile update functionality combined with improper handling of array inputs by PHP's…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,82 % · rekomendacja wg zapisanej polityki
Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server Script execution when one server script triggers another. Authenticated high-privileged users can craft a Server Script that triggers other server…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint. Attackers can send arbitrarily large or concurrent request bodies to POST /api/v1/sns/{tenant}/{event} with any UUID,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
FutureNet MA and IP-K series provided by Century Systems Co., Ltd. put the firmware version and the garbage collection information on the internal web page. With some crafted HTTP request, they can be accessed without authentication.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
6,9
0,32 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.