Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the server, causing a denial of service. When re-initialization of the DXGI Desktop Duplication driver fails in applyNewScreenProperties()…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment id…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a NULL pointer dereference in GraphQL variable processing.
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Incorrect authorization in Sync in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Missing authorization in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to algorithmic complexity in linked-list traversal.
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerprint-validation path calls Ed25519PasswordAuth.hash() through Authentication.validateFingerPrint, but Ed25519PasswordAuth.hash()…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve Embedded Sensitive Data.This issue affects WP Rollback: from n/a through 3.1.2.
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints, allowing unauthenticated users to retrieve the site's scheduled background tasks and their arguments, which include order identifiers and, when…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash() in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks.
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Incorrect authorization in PDF in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker's key. When its recipient opened a signed…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers could forward unmasked bytes. Code inside an authorized sandbox could use this to recover host-managed OAuth access and refresh…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
CVSS
5,9
EPSS
0,16 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the server, causing a denial of service. When re-initialization of the DXGI Desktop Duplication driver fails in applyNewScreenProperties()…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment id…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a NULL pointer dereference in GraphQL variable processing.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Incorrect authorization in Sync in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Missing authorization in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to algorithmic complexity in linked-list traversal.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerprint-validation path calls Ed25519PasswordAuth.hash() through Authentication.validateFingerPrint, but Ed25519PasswordAuth.hash()…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve Embedded Sensitive Data.This issue affects WP Rollback: from n/a through 3.1.2.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints, allowing unauthenticated users to retrieve the site's scheduled background tasks and their arguments, which include order identifiers and, when…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash() in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Incorrect authorization in PDF in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker's key. When its recipient opened a signed…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers could forward unmasked bytes. Code inside an authorized sandbox could use this to recover host-managed OAuth access and refresh…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
5,9
0,16 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.