Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in report_content…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6 - modOsTouchSliderHelper::getAjax(), wired through Joomla’s core com_ajax dispatcher, is the single handler behind every data-management operation this module exposes. No call to…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addresses. Attackers can reconnect from fresh IPv6 addresses in their /64 allocation or flush the 20,000-entry FIFO ban list to…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon will relay configuration parameters, user-supplied relay host…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,73 % · rekomendacja wg zapisanej polityki
PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translate_file handler passes user URLs to download_with_limit without scheme or address validation,…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthenticated attackers can send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as a currently…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
CVSS
6,9
EPSS
0,21 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in report_content…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6 - modOsTouchSliderHelper::getAjax(), wired through Joomla’s core com_ajax dispatcher, is the single handler behind every data-management operation this module exposes. No call to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addresses. Attackers can reconnect from fresh IPv6 addresses in their /64 allocation or flush the 20,000-entry FIFO ban list to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon will relay configuration parameters, user-supplied relay host…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,73 % · rekomendacja wg zapisanej polityki
PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translate_file handler passes user URLs to download_with_limit without scheme or address validation,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthenticated attackers can send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as a currently…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
6,9
0,21 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.