Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,56 % · rekomendacja wg zapisanej polityki
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,56 % · rekomendacja wg zapisanej polityki
The mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. An attacker with low-privilege CLI access can create a symbolic link that references a privileged…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,56 % · rekomendacja wg zapisanej polityki
ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,56 % · rekomendacja wg zapisanej polityki
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,56 % · rekomendacja wg zapisanej polityki
The mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. An attacker with low-privilege CLI access can create a symbolic link that references a privileged…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,56 % · rekomendacja wg zapisanej polityki