Baza CVE

Unauthenticated Local File Inclusion in Tonda < 2.6 versions.

Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.

Unauthenticated Broken Access Control in Notification Master &#8211; Real-Time WordPress Notifications With Email, SMS, Webhooks &amp; More <= 1.7.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3.2.5 versions.

Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebRehab Super Forms super-forms allows Path Traversal.This issue affects Super Forms: from n/a through 6.3.316.

Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.

Błąd w fast-uri umożliwia atakującemu przeprowadzenie oszukańczego przekierowania.

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or…

Błąd w fast-uri pozwala na obejście polityki bezpieczeństwa przez niezgodność hostów.

Błąd w fast-uri pozwala na atak typu server-side request forgery przez nieprawidłowe adresy IPv6.

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

Błąd w fast-uri umożliwia atak typu server-side request forgery przez podwójne dekodowanie hosta.

DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a…

The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate…

Wstrzyknięcie poleceń w Sakura Editor umożliwia wykonanie dowolnych komend na komputerze użytkownika.

4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit a Relative Path Traversal flaw to download arbitrary system files.

Błąd w funkcji verify() w Velociraptor pozwala na nadpisywanie artefaktów bez odpowiednich uprawnień.

A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpcon_check_session_url of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed…

A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the component HTTP Request Handler. Performing a manipulation of the argument Profile results in stack-based buffer overflow. The attack is…

A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. Executing a manipulation of the argument ssid can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be…

Wykorzystanie podatności w exceljs pozwala na odczyt dowolnych plików przez atakującego.