Podatności

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs…

CVSS 6,9 · EPSS 0,84 % · rekomendacja wg zapisanej polityki

Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validates…

CVSS 6,9 · EPSS 0,48 % · rekomendacja wg zapisanej polityki

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unauthenticated callers after installation, with observed response size and latency suggesting that the schema is regenerated…

CVSS 6,9 · EPSS 0,37 % · rekomendacja wg zapisanej polityki

ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an unvalidated provider base_url. Attackers can set base_url via the provider config endpoint and trigger POST /api/v1/models/check to…

CVSS 6,9 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert…

CVSS 6,9 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depack_p61a() in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into…

CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki

libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encrypted_key_read_data() that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to…

CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki

catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of process_item() in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to…

CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki

libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adl_openFile() or…

CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki

libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write…

CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki

FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played,…

CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server…

CVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki

libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry…

CVSS 6,9 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row…

CVSS 6,9 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed RTF properties. Attackers can deliver a crafted winmail.dat whose decompressed RTF lacks a NUL terminator, causing printf to over-read,…

CVSS 6,9 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the…

CVSS 6,9 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.

CVSS 6,9 · rekomendacja wg zapisanej polityki

The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without further authentication…

CVSS 6,9 · rekomendacja wg zapisanej polityki

The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated…

CVSS 6,8 · EPSS 0,46 % · rekomendacja wg zapisanej polityki

A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.

CVSS 6,8 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMF_Load() loader that allows attackers to read beyond allocated memory by supplying a crafted IMF module. Attackers can enable the linear-period header flag and map notes to out-of-range samples, causing noteindex…

CVSS 6,8 · EPSS 0,2 % · rekomendacja wg zapisanej polityki

WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation,…

CVSS 6,8 · EPSS 0,2 % · rekomendacja wg zapisanej polityki

Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById() to…

CVSS 6,8 · EPSS 0,2 % · rekomendacja wg zapisanej polityki

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on.

CVSS 6,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki

The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured.

CVSS 6,8 · EPSS 0,18 % · rekomendacja wg zapisanej polityki