Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting…
Opis źródłowy NVD · ENCVSS 6,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused,…
Opis źródłowy NVD · ENCVSS 6,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a…
Opis źródłowy NVD · ENCVSS 6,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and…
Opis źródłowy NVD · ENCVSS 6,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg). SecuredSessionFactoryImpl.checkSecurity() resolves the roles required for an invocation and, when no ACL rule matches the command, fails…
Opis źródłowy NVD · ENCVSS 6,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme…
Opis źródłowy NVD · ENCVSS 6,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there.
A server that serves several SNI…
Opis źródłowy NVD · ENCVSS 6,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and…
Opis źródłowy NVD · ENCVSS 6,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function _curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are…
Opis źródłowy NVD · ENCVSS 6,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-Ne) is configured. Attackers can send a client probe that…
Opis źródłowy NVD · ENCVSS 6,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrieve the full title, content, image, tags, author and publish…
Opis źródłowy NVD · ENCVSS 6,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit…
Opis źródłowy NVD · ENCVSS 6,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service.
Opis źródłowy NVD · ENCVSS 6,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use…
Opis źródłowy NVD · ENCVSS 6,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
CVSS
6,3
EPSS
0,35 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg). SecuredSessionFactoryImpl.checkSecurity() resolves the roles required for an invocation and, when no ACL rule matches the command, fails…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there.
A server that serves several SNI…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function _curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option (-Ne) is configured. Attackers can send a client probe that…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrieve the full title, content, image, tags, author and publish…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
6,3
0,35 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.