Podatności

ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allocations by supplying certain arguments. Attackers can repeatedly invoke the -process option with crafted arguments to gradually exhaust memory and degrade…

CVSS 4,8 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured api_key because the router's Args struct lacks a redact attribute for it. Attackers with access to router logs, container output, or OTLP telemetry can recover the Bearer…

CVSS 4,8 · EPSS 0,11 % · rekomendacja wg zapisanej polityki

A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63 bytes of adjacent heap memory, or cause a crash, via a crafted RLE Lossless DICOM file whose pixel data fragment is shorter than the 64-byte…

CVSS 4,8 · EPSS 0,11 % · rekomendacja wg zapisanej polityki

A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, libijg12 and libijg16) of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extend_test[] and extend_offset[] tables, causing incorrectly decoded pixel data or a crash, via a DICOM…

CVSS 4,8 · EPSS 0,11 % · rekomendacja wg zapisanej polityki

phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted FAQs because Search::searchDatabase() never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search…

CVSS 4,8 · EPSS 0,1 % · rekomendacja wg zapisanej polityki

A security flaw has been discovered in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. This impacts the function TemplateController.save of the file /system/cms/template/save of the component Backend Template Editor. The manipulation results in path traversal. The attack may be…

CVSS 4,7 · EPSS 0,54 % · rekomendacja wg zapisanej polityki

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise returns the stored branding.footerHtml value through the unauthenticated public site configuration API without server-side sanitization. The FileRise frontend already…

CVSS 4,8 · rekomendacja wg zapisanej polityki

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, FileRise public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared folder to a sibling directory under the upload root. An…

CVSS 4,8 · rekomendacja wg zapisanej polityki

holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent,…

CVSS 4,8 · rekomendacja wg zapisanej polityki

Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory via crafted variable labels. Attackers can supply a graph.nnef with '../' sequences or absolute paths in labels to create or…

CVSS 4,8 · rekomendacja wg zapisanej polityki

OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class files. Attackers can craft bytecode with many forward jump targets in constructors, causing unbounded stack copies in…

CVSS 4,8 · rekomendacja wg zapisanej polityki

Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki

Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki

Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki

Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki

Exposure of sensitive system information to an unauthorized control sphere in Windows Installer allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki

Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,36 % · rekomendacja wg zapisanej polityki

Generation of error message containing sensitive information in Windows NTFS allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,36 % · rekomendacja wg zapisanej polityki

A security flaw has been discovered in Zen Cart up to 2.2.2. Affected by this issue is some unknown functionality of the file admin/modules.php of the component Module Configuration. The manipulation of the argument configuration results in sql injection. The attack may be launched remotely. The…

CVSS 4,7 · EPSS 0,33 % · rekomendacja wg zapisanej polityki

Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,33 % · rekomendacja wg zapisanej polityki

Use after free in Windows Graphics Kernel allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Use after free in Windows Kernel allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.

CVSS 4,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki