KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Wykorzystanie podatności w SIMATIC S7-PLCSIM Advanced może prowadzić do awarii aplikacji.
Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with…
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker…
Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker…
Luka w Pega Browser Extension umożliwia atakującym wyświetlenie nieoczekiwanych komunikatów.
Przepełnienie pamięci w FPDI umożliwia atakującym zdalne zablokowanie usługi.
In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its project_id defaulted to the accepting project rather than…
Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's…
An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation.
Luka w CodexBar umożliwia atakującym przechwytywanie wrażliwych poświadczeń przez przekierowania.
Przepełnienie bufora w urządzeniach Teltonika RUTOS może prowadzić do odmowy usługi.
Nieprawidłowa interpretacja żądań HTTP w .NET pozwala atakującemu na ominięcie zabezpieczeń.
Nieprawidłowe usuwanie wrażliwych danych w .NET umożliwia ujawnienie informacji przez sieć.
An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data.
A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, for…
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record…
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its…
Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through…
Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Administer Workforce). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft…
libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes,…
Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can…
The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling…
Przepełnienie wskaźnika w Envoy może prowadzić do awarii pracownika serwera.
An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged authenticated user may access a configuration file containing the hashed password of the administrative account. Successful exploitation of this…
Wielokrotne użycie kontekstów JavaScript w Zabbixu prowadzi do wycieku danych dla nieuprawnionych administratorów.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Wykorzystanie podatności w SIMATIC S7-PLCSIM Advanced może prowadzić do awarii aplikacji. | Wykorzystanie podatności w SIMATIC S7-PLCSIM Advanced może prowadzić do awarii aplikacji. |
Do wiadomości | 6,0 | 0,27 % | ||
| Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset… | Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with… |
Do wiadomości | 6,0 | 0,26 % | ||
| Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like… | Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker… |
Do wiadomości | 6,0 | 0,26 % | ||
| Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and… | Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker… |
Do wiadomości | 6,0 | 0,26 % | ||
| Luka w Pega Browser Extension umożliwia atakującym wyświetlenie nieoczekiwanych komunikatów. | Luka w Pega Browser Extension umożliwia atakującym wyświetlenie nieoczekiwanych komunikatów. |
Do wiadomości | 6,0 | 0,26 % | ||
| Przepełnienie pamięci w FPDI umożliwia atakującym zdalne zablokowanie usługi. | Przepełnienie pamięci w FPDI umożliwia atakującym zdalne zablokowanie usługi. |
Do wiadomości | 6,0 | 0,26 % | ||
| In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private… | In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its project_id defaulted to the accepting project rather than… |
Do wiadomości | 6,0 | 0,26 % | ||
| Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped… | Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's… |
Do wiadomości | 6,0 | 0,26 % | ||
| An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a… | An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation. |
Do wiadomości | 6,0 | 0,26 % | ||
| Luka w CodexBar umożliwia atakującym przechwytywanie wrażliwych poświadczeń przez przekierowania. | Luka w CodexBar umożliwia atakującym przechwytywanie wrażliwych poświadczeń przez przekierowania. |
Do wiadomości | 6,0 | 0,25 % | ||
| Przepełnienie bufora w urządzeniach Teltonika RUTOS może prowadzić do odmowy usługi. | Przepełnienie bufora w urządzeniach Teltonika RUTOS może prowadzić do odmowy usługi. |
Do wiadomości | 6,0 | 0,25 % | ||
| Nieprawidłowa interpretacja żądań HTTP w .NET pozwala atakującemu na ominięcie zabezpieczeń. | Nieprawidłowa interpretacja żądań HTTP w .NET pozwala atakującemu na ominięcie zabezpieczeń. |
Do wiadomości | 5,9 | 0,75 % | ||
| Nieprawidłowe usuwanie wrażliwych danych w .NET umożliwia ujawnienie informacji przez sieć. | Nieprawidłowe usuwanie wrażliwych danych w .NET umożliwia ujawnienie informacji przez sieć. |
Do wiadomości | 5,9 | 0,75 % | ||
| An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network… | An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data. |
Do wiadomości | 6,0 | 0,25 % | ||
| A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. | A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, for… |
Do wiadomości | 6,0 | 0,25 % | ||
| Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only… | Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record… |
Do wiadomości | 6,0 | 0,25 % | ||
| Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. | Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its… |
Do wiadomości | 6,0 | 0,25 % | ||
| Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record… | Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through… |
Do wiadomości | 6,0 | 0,25 % | ||
| Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Administer Workforce). | Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Administer Workforce). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft… |
Do wiadomości | 6,0 | 0,25 % | ||
| libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow… | libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes,… |
Do wiadomości | 6,0 | 0,24 % | ||
| Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been… | Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can… |
Do wiadomości | 6,0 | 0,24 % | ||
| The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. | The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling… |
Do wiadomości | 6,0 | 0,24 % | ||
| Przepełnienie wskaźnika w Envoy może prowadzić do awarii pracownika serwera. | Przepełnienie wskaźnika w Envoy może prowadzić do awarii pracownika serwera. |
Do wiadomości | 5,9 | 0,74 % | ||
| An improper ownership management vulnerability has been identified in Moxa’s Secure Router. | An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged authenticated user may access a configuration file containing the hashed password of the administrative account. Successful exploitation of this… |
Do wiadomości | 6,0 | 0,24 % | ||
| Wielokrotne użycie kontekstów JavaScript w Zabbixu prowadzi do wycieku danych dla nieuprawnionych administratorów. | Wielokrotne użycie kontekstów JavaScript w Zabbixu prowadzi do wycieku danych dla nieuprawnionych administratorów. |
Do wiadomości | 6,0 | 0,24 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.