Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms,…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling.…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[width - 1] without rejecting that geometry.…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names,…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data export functionality. An authenticated user with Viewer privileges could write attacker influenced content to file system locations accessible to the application service. Successful…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availability and integrity.
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,94 % · rekomendacja wg zapisanej polityki
Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte-* headers, and AuthenticationHeaderResolver.resolveWorkspace consults…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate payment and order states of arbritrary…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A security issue was discovered in DataMosaix Private Cloud, allowing users with low privilege to perform sensitive database operations through exposed API endpoints.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during policy evaluation. Attackers can bypass security policy checks by providing falsified evidence, causing the validator to miss unsafe bucket…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters.…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad.…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
CVSS
8,7
EPSS
0,43 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[width - 1] without rejecting that geometry.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data export functionality. An authenticated user with Viewer privileges could write attacker influenced content to file system locations accessible to the application service. Successful…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availability and integrity.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,94 % · rekomendacja wg zapisanej polityki
Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte-* headers, and AuthenticationHeaderResolver.resolveWorkspace consults…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate payment and order states of arbritrary…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A security issue was discovered in DataMosaix Private Cloud, allowing users with low privilege to perform sensitive database operations through exposed API endpoints.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during policy evaluation. Attackers can bypass security policy checks by providing falsified evidence, causing the validator to miss unsafe bucket…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
8,7
0,43 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjePrzetwarzanie niepełne
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOstatnie przetworzenie zakończoneData modelu znajduje się przy rekordzie.