Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web_fetch or URL-based knowledge import to reach…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3.
Ash.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) applied only the root resource's read policy before running the…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,77 % · rekomendacja wg zapisanej polityki
libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its project_id defaulted to the accepting project rather than…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation.
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data.
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, for…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows.
When a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert.
When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship.
When a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Administer Workforce). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes,…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
CVSS
6,0
EPSS
0,24 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web_fetch or URL-based knowledge import to reach…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3.
Ash.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) applied only the root resource's read policy before running the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,77 % · rekomendacja wg zapisanej polityki
libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its project_id defaulted to the accepting project rather than…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, for…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows.
When a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert.
When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship.
When a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Administer Workforce). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
6,0
0,24 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.