Baza CVE

The LoRaWAN Fragmented Data Block Transport service (subsys/lorawan/services/frag_transport.c) does not validate the fragment counter in a received DATA_FRAGMENT command before forwarding it to the configured decoder. In frag_transport_package_callback() the value frag_counter = hdr->frag_index_n…

A use-after-free exists in the Zephyr second-generation work queue (kernel/work.c) in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler work_timeout() is in flight (blocked acquiring the work-queue spinlock), a concurrent cancellation…

Ujawnienie informacji w CKAN MCP Server pozwala na wyciek danych o systemie i błędach.

W CKAN MCP Server występuje podatność na spoofing, umożliwiająca atak na złośliwy serwer.

Kolizja parametrów w CKAN MCP Server umożliwia atakującemu podmianę odpowiedzi w pamięci podręcznej.

Luka w Concourse pozwala na phishing poprzez przekierowanie użytkownika na złośliwą stronę.

Błąd w crun umożliwia tworzenie wrażliwych węzłów urządzeń poza kontenerem.

Błąd w kas umożliwia oszustwo przy sprawdzaniu repozytoriów przez atakującego.

Błąd w kas umożliwia atakującemu podmianę repozytoriów, co może prowadzić do złośliwego kodu.

Wykonanie ataku Server-Side Request Forgery w compliance-trestle umożliwia dostęp do wewnętrznych usług.

A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the component Backend Reporting Endpoint. The manipulation leads to authorization bypass. Remote exploitation of the attack is possible. The…

A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue affects the function save_doctor of the file /save_file.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit is now public and may be used.

A flaw has been found in TRENDNET TEW-813DRU 1.01b01. Impacted is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. This manipulation causes incorrect default permissions. The attack is possible to be carried out remotely. A high degree of complexity is needed for the…

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

Wykryta podatność CSRF w KUNBUS PiCtory umożliwia zdalne zmiany w konfiguracji przez atakującego.

Wykorzystanie przejścia ścieżki w KUNBUS RevPiPyLoad pozwala na odczytanie wrażliwych plików.

Wykorzystanie przejścia ścieżki w KUNBUS RevPiPyLoad pozwala na usunięcie dowolnych plików.

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Use of Hard-coded Credentials vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Impersonation Feature. This manipulation of the argument ID causes authorization bypass. The attack can be initiated…

A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletion Endpoint. Such manipulation leads to improper access controls. The attack can be launched remotely. The exploit is publicly available and…

A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may…

A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search. Executing a manipulation of the argument Query can lead to information disclosure. The attack may be launched remotely. The exploit has…

Warunek wyścigu w KUNBUS piControl umożliwia lokalnemu atakującemu usunięcie pamięci jądra.

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific…

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an…