Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK:…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in z_impl_updatehub_probe() (subsys/mgmt/updatehub/updatehub.c). The decoder treats every descriptor field as optional — json_obj_parse() returns a bitmask of the fields it actually decoded and…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Missing authorization in HTTP2 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via crafted network traffic. (Chromium security severity: Medium)
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
The Filter & Grids plugin for WordPress is vulnerable to SQL Injection via the 'phrase' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray) allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH message received from the broker in an internal map (qos2inbound) while awaiting the corresponding PUBREL packet to…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time scalar multiplication through `Point#mul` or `scalar_multiply_ct` can leak timing information about a secret scalar when compiled by a toolchain that reconstructs branchless selection…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte,…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
CVSS
5,9
EPSS
0,28 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK:…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in z_impl_updatehub_probe() (subsys/mgmt/updatehub/updatehub.c). The decoder treats every descriptor field as optional — json_obj_parse() returns a bitmask of the fields it actually decoded and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Missing authorization in HTTP2 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via crafted network traffic. (Chromium security severity: Medium)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
The Filter & Grids plugin for WordPress is vulnerable to SQL Injection via the 'phrase' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray) allocates a Java array sized by a server-declared 32-bit dimension count with no upper bound. A malicious or compromised…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH message received from the broker in an internal map (qos2inbound) while awaiting the corresponding PUBREL packet to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time scalar multiplication through `Point#mul` or `scalar_multiply_ct` can leak timing information about a secret scalar when compiled by a toolchain that reconstructs branchless selection…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
5,9
0,28 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.