Podatności

The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with…

CVSS 6,8 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user-mode application allows a low-privileged attacker to act as a trusted process and connect to the named pipe…

alert CERT.pl · CVSS 6,8 · EPSS 0,14 % · rekomendacja wg zapisanej polityki

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the…

CVSS 6,8 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

Game Music Emu (libgme) through 0.6.5 contains a global out-of-bounds read vulnerability in Classic_Emu::mute_voices_ that allows attackers to crash applications by supplying NSF files whose voice count exceeds the 16-entry voice-type table. Attackers can craft an NSF header with chip_flags 0x3F,…

CVSS 6,8 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3_detect() in parseutils.c that reads past truncated miniSEED 2 record buffers. Attackers can supply a 40 to 47 byte buffer passing MS2_ISVALIDHEADER to msr3_parse() or ms3_detect(), over-reading up to 8 bytes…

CVSS 6,8 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs()…

CVSS 6,8 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilove_xbin() in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte such as 0x7F to read past the input…

CVSS 6,8 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_rle8() and bmp_decode_rle4() because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap…

CVSS 6,8 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmo_unpacker::decrypt(), opened via…

CVSS 6,8 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in…

CVSS 6,8 · EPSS 0,09 % · rekomendacja wg zapisanej polityki

A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error.

CVSS 6,8 · EPSS 0,09 % · rekomendacja wg zapisanej polityki

Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo,…

CVSS 6,6 · EPSS 0,98 % · rekomendacja wg zapisanej polityki

Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to…

CVSS 6,6 · EPSS 0,95 % · rekomendacja wg zapisanej polityki

Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making…

CVSS 6,6 · EPSS 0,89 % · rekomendacja wg zapisanej polityki

Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method.

CVSS 6,5 · EPSS 1,12 % · rekomendacja wg zapisanej polityki

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server,…

CVSS 6,5 · EPSS 0,58 % · rekomendacja wg zapisanej polityki

Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

CVSS 6,5 · EPSS 0,53 % · rekomendacja wg zapisanej polityki

Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

CVSS 6,5 · EPSS 0,51 % · rekomendacja wg zapisanej polityki

Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

CVSS 6,5 · EPSS 0,51 % · rekomendacja wg zapisanej polityki

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

CVSS 6,5 · EPSS 0,51 % · rekomendacja wg zapisanej polityki

Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

CVSS 6,5 · EPSS 0,51 % · rekomendacja wg zapisanej polityki

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

CVSS 6,5 · EPSS 0,51 % · rekomendacja wg zapisanej polityki

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

CVSS 6,5 · EPSS 0,51 % · rekomendacja wg zapisanej polityki

kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's join discards the base…

CVSS 6,5 · EPSS 0,39 % · rekomendacja wg zapisanej polityki

The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wsp_get_posts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate() method accepts any…

CVSS 6,5 · EPSS 0,35 % · rekomendacja wg zapisanej polityki