KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Obejście walidacji w Froxlor pozwala atakującemu na modyfikację kluczy API bez uwierzytelnienia.
Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026.
Nieprawidłowa walidacja danych w Smart Switch umożliwia sąsiednim atakującym dostęp do wrażliwych danych.
Aplikacja może uzyskać dostęp do wrażliwych danych użytkownika przez brak HTTPS.
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authenticated user to modify other participants’ votes in polls without authorization. The backend relies solely on the participantId parameter to…
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability allows any authenticated user to change the display names of other participants in polls without being an admin or the poll owner. By manipulating the…
IBM QRadar SIEM 7.5 through 7.5.0 UP14 stores user credentials in configuration files in source control which can be read by an authenticated user.
Wstrzyknięcie kodu w Easy Appointments umożliwia atak XSS.
Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions.
Luka w Grafanie pozwala na kradzież danych uwierzytelniających przez edycję punktów kontaktowych.
A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been published and may be used.
Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines,…
FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a semicolon-containing unrecognized…
A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only…
The MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the import-csv REST API endpoint in all versions up to, and including, 2.3.1. This is due to the endpoint using `upload_files`…
Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5.
Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for…
Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.
In multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14.
DoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availability.
Błąd w Hono pozwala na uwierzytelnienie z użyciem JWT bez poprawnego schematu Bearer.
1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP addresses as proxies (TrustedProxies = 0.0.0.0/0), allowing any client to spoof the X-Forwarded-For header. Since all IP-based access…
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization flaw in the comment creation endpoint allows authenticated users to impersonate any other user by altering the authorName field in the API request. This enables attackers to post comments…
tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Obejście walidacji w Froxlor pozwala atakującemu na modyfikację kluczy API bez uwierzytelnienia. | Obejście walidacji w Froxlor pozwala atakującemu na modyfikację kluczy API bez uwierzytelnienia. |
Do wiadomości | 6,5 | 0,26 % | ||
| Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application… | Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026. |
Do wiadomości | 6,5 | 0,26 % | ||
| Nieprawidłowa walidacja danych w Smart Switch umożliwia sąsiednim atakującym dostęp do wrażliwych danych. | Nieprawidłowa walidacja danych w Smart Switch umożliwia sąsiednim atakującym dostęp do wrażliwych danych. |
Do wiadomości | 6,5 | 0,26 % | ||
| Aplikacja może uzyskać dostęp do wrażliwych danych użytkownika przez brak HTTPS. | Aplikacja może uzyskać dostęp do wrażliwych danych użytkownika przez brak HTTPS. |
Do wiadomości | 6,5 | 0,26 % | ||
| Rallly is an open-source scheduling and collaboration tool. | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authenticated user to modify other participants’ votes in polls without authorization. The backend relies solely on the participantId parameter to… |
Do wiadomości | 6,5 | 0,26 % | ||
| Rallly is an open-source scheduling and collaboration tool. | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability allows any authenticated user to change the display names of other participants in polls without being an admin or the poll owner. By manipulating the… |
Do wiadomości | 6,5 | 0,26 % | ||
| IBM QRadar SIEM 7.5 through 7.5.0 UP14 stores user credentials in configuration files in source control which can be read by an… | IBM QRadar SIEM 7.5 through 7.5.0 UP14 stores user credentials in configuration files in source control which can be read by an authenticated user. |
Do wiadomości | 6,5 | 0,26 % | ||
| Wstrzyknięcie kodu w Easy Appointments umożliwia atak XSS. | Wstrzyknięcie kodu w Easy Appointments umożliwia atak XSS. |
Do wiadomości | 6,5 | 0,26 % | ||
| Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions. | Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions. |
Do wiadomości | 6,5 | 0,26 % | ||
| Luka w Grafanie pozwala na kradzież danych uwierzytelniających przez edycję punktów kontaktowych. | Luka w Grafanie pozwala na kradzież danych uwierzytelniających przez edycję punktów kontaktowych. |
Do wiadomości | 6,5 | 0,26 % | ||
| A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. | A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been published and may be used. |
Do wiadomości | 6,5 | 0,26 % | ||
| Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust… | Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines,… |
Do wiadomości | 6,5 | 0,25 % | ||
| FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust… | FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a semicolon-containing unrecognized… |
Do wiadomości | 6,5 | 0,25 % | ||
| A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata… | A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only… |
Do wiadomości | 6,5 | 0,25 % | ||
| The MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress is vulnerable to unauthorized data deletion due to a… | The MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the import-csv REST API endpoint in all versions up to, and including, 2.3.1. This is due to the endpoint using `upload_files`… |
Do wiadomości | 6,5 | 0,25 % | ||
| Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows… | Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5. |
Do wiadomości | 6,5 | 0,25 % | ||
| Payload is a free and open source headless content management system. | Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for… |
Do wiadomości | 6,5 | 0,25 % | ||
| Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions. | Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions. |
Do wiadomości | 6,5 | 0,25 % | ||
| In multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check. | In multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
Do wiadomości | 6,5 | 0,25 % | ||
| Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security… | Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14. |
Do wiadomości | 6,5 | 0,25 % | ||
| DoS vulnerability in the vibration service. | DoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availability. |
Do wiadomości | 6,5 | 0,25 % | ||
| Błąd w Hono pozwala na uwierzytelnienie z użyciem JWT bez poprawnego schematu Bearer. | Błąd w Hono pozwala na uwierzytelnienie z użyciem JWT bez poprawnego schematu Bearer. |
Do wiadomości | 6,5 | 0,25 % | ||
| 1Panel is an open-source, web-based control panel for Linux server management. | 1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP addresses as proxies (TrustedProxies = 0.0.0.0/0), allowing any client to spoof the X-Forwarded-For header. Since all IP-based access… |
Do wiadomości | 6,5 | 0,25 % | ||
| Rallly is an open-source scheduling and collaboration tool. | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization flaw in the comment creation endpoint allows authenticated users to impersonate any other user by altering the authorName field in the API request. This enables attackers to post comments… |
Do wiadomości | 6,5 | 0,25 % | ||
| tinytag is a Python library for reading audio file metadata. | tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed… |
Do wiadomości | 6,5 | 0,25 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.