KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute…
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTENSIONS and…
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML that bypasses moderateSanitizeHtml(). When another user opens the template in edit mode and clientCspDisabled is true, the…
The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbus_proxy_msg carries a fixed-size channel_name[] array as its last member, and nothing in the transport…
Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../<name>_x/file to create or overwrite files in sibling…
CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFI_stridx_c to scan past…
vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode_vector_quantized_mlt_indices() past the stack…
LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the…
PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codepoint() that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences,…
The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record, allowing an administrator of a single subsite on a multisite…
A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing…
A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.…
A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the…
Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking…
ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An attacker can leverage these functions to read relevant information.
ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs.
ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information.
GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys…
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length()…
OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that…
VeraCrypt provides disk encryption with strong security based on TrueCrypt. In 1.26.29 and earlier, selected metadata IOCTL handlers in the VeraCrypt Windows veracrypt.sys driver accept caller-supplied object-manager and device paths broader than supported VeraCrypt workflows require. A local user…
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to…
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP…
The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Contao is an Open Source CMS. | Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute… |
Do wiadomości | 3,5 | 0,11 % | ||
| Helium is a free online student planner for classes, homework, grades, and notes. | Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTENSIONS and… |
Do wiadomości | 3,5 | Nieustalone | ||
| EspoCRM is an open source customer relationship management application. | EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML that bypasses moderateSanitizeHtml(). When another user opens the template in edit mode and clientCspDisabled is true, the… |
Do wiadomości | 3,5 | Nieustalone | ||
| The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected inter-domain… | The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbus_proxy_msg carries a fixed-size channel_name[] array as its last member, and nothing in the transport… |
Do wiadomości | 3,4 | 0,11 % | ||
| Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the… | Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../<name>_x/file to create or overwrite files in sibling… |
Do wiadomości | 3,3 | 0,21 % | ||
| CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications… | CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFI_stridx_c to scan past… |
Do wiadomości | 3,3 | 0,17 % | ||
| vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader… | vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode_vector_quantized_mlt_indices() past the stack… |
Do wiadomości | 3,3 | 0,17 % | ||
| LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in… | LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the… |
Do wiadomości | 3,3 | 0,17 % | ||
| PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codepoint() that allows attackers to read past name… | PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codepoint() that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences,… |
Do wiadomości | 3,3 | 0,17 % | ||
| The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives… | The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record, allowing an administrator of a single subsite on a multisite… |
Do wiadomości | 3,3 | 0,16 % | ||
| A flaw was found in BusyBox dpkg. | A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing… |
Do wiadomości | 3,3 | 0,15 % | ||
| A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. | A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.… |
Do wiadomości | 3,3 | 0,14 % | ||
| A flaw was found in device-mapper-persistent-data. | A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the… |
Do wiadomości | 3,3 | 0,14 % | ||
| Talos Linux is a Linux distribution built for Kubernetes deployments. | Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking… |
Do wiadomości | 3,3 | 0,13 % | ||
| ZTE Z80 Ultra has an interface permission validation vulnerability. | ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An attacker can leverage these functions to read relevant information. |
Do wiadomości | 3,3 | 0,13 % | ||
| ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by… | ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs. |
Do wiadomości | 3,3 | 0,13 % | ||
| ZTE Z80 Ultra has a local information disclosure vulnerability. | ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information. |
Do wiadomości | 3,3 | 0,11 % | ||
| GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware… | GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys… |
Do wiadomości | 3,3 | 0,11 % | ||
| OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. | OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length()… |
Do wiadomości | 3,3 | 0,1 % | ||
| OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). | OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that… |
Do wiadomości | 3,3 | 0,1 % | ||
| VeraCrypt provides disk encryption with strong security based on TrueCrypt. | VeraCrypt provides disk encryption with strong security based on TrueCrypt. In 1.26.29 and earlier, selected metadata IOCTL handlers in the VeraCrypt Windows veracrypt.sys driver accept caller-supplied object-manager and device paths broader than supported VeraCrypt workflows require. A local user… |
Do wiadomości | 3,3 | 0,1 % | ||
| IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input… | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation. |
Do wiadomości | 3,3 | 0,09 % | ||
| OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to… |
Do wiadomości | 3,3 | Nieustalone | ||
| miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix… | miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP… |
Do wiadomości | 3,1 | 0,29 % | ||
| The AI Puffer – Chat. | The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for… |
Do wiadomości | 3,1 | 0,27 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.