Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the server is vulnerable to an unauthenticated denial of service in which a single malformed command crashes the entire process. Its wire protocol is line-based, and several command handlers slice or index the…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may leak some sensitive info, such as source and path. Versions 1.3.2-stable and 1.4.1-beta fix the issue. No known workarounds are available.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt_on gate. Attackers can plant instructions in ingested content such as fetched web pages, so the agent calls…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Advantech iView versions 5.7.05.7057 and prior do not properly sanitize SNMP v1 trap (Port 162) requests, which could allow an attacker to inject SQL commands.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers during ticket downloads.
This could allow an attacker who can manipulate the ticket response to…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker who is able to access the Anchore Enterprise API could issue an API call capable of modifying user permissions to gain access to…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the server is vulnerable to an unauthenticated denial of service in which a single malformed command crashes the entire process. Its wire protocol is line-based, and several command handlers slice or index the…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may leak some sensitive info, such as source and path. Versions 1.3.2-stable and 1.4.1-beta fix the issue. No known workarounds are available.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt_on gate. Attackers can plant instructions in ingested content such as fetched web pages, so the agent calls…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Advantech iView versions 5.7.05.7057 and prior do not properly sanitize SNMP v1 trap (Port 162) requests, which could allow an attacker to inject SQL commands.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers during ticket downloads.
This could allow an attacker who can manipulate the ticket response to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker who is able to access the Anchore Enterprise API could issue an API call capable of modifying user permissions to gain access to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki