KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional conditions when processing crafted CIP packets sent to the adapter. A power cycle is required to recover the module and associated I/O.
Luka w Spotfire umożliwia zdalne wykonanie kodu w różnych modułach serwera.
A denial-of-service security issue exists in the 1719-AENTR. The security issue stems from improper handling of a UDP unicast network storm, which causes the device to become overloaded and lose communication. A power cycle is required to recover.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that, under certain conditions could have allowed an authenticated user to perform unauthorized actions on behalf of another user by creating wiki pages with…
Błąd eskalacji uprawnień w FreeIPA pozwala na podszywanie się pod uprzywilejowane usługi.
Luka w Oracle Unified Directory pozwala na nieautoryzowane modyfikacje danych i ataki DoS.
ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} or the knowledgebaseId parameter of…
Wykrycie wskaźnika NULL w FreeRDP prowadzi do awarii procesu klienta przy emulacji karty inteligentnej.
Podatność na podwójne zwolnienie w open-iscsi pozwala nieautoryzowanemu atakującemu na DoS.
Brak limitu na liczbę pętli w AutoGPT prowadzi do wyczerpania przestrzeni dyskowej i DoS.
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last() to extract…
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract…
An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus.
Console is a network used to control Gorilla Tag mods' users and other users on the network. Prior to version 2.8.0, a path traversal vulnerability exists where complicated combinations of backslashes and periods can be used to escape the Gorilla Tag path and write to unwanted directories. This…
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the…
LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in…
SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and…
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in `MessageBuffer::computeRequiredCapacity()` causes the receiving…
Brak weryfikacji URI w MRBS pozwala na nieautoryzowane pobieranie zasobów.
Brak uwierzytelnienia w Hospital Manager Backend Services pozwala na ujawnienie wrażliwych danych.
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with…
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the…
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary…
Luka XSS w Adobe Connect pozwala na eskalację uprawnień przez złośliwe skrypty.
Luka umożliwiająca nieautoryzowanemu atakującemu odczyt dowolnych plików z hosta pozwala na eskalację uprawnień.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| A denial-of-service security issue exists in the affected products. | A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional conditions when processing crafted CIP packets sent to the adapter. A power cycle is required to recover the module and associated I/O. |
Obserwuj | 8,7 | 0,43 % | ||
| Luka w Spotfire umożliwia zdalne wykonanie kodu w różnych modułach serwera. | Luka w Spotfire umożliwia zdalne wykonanie kodu w różnych modułach serwera. |
Obserwuj | 8,7 | 0,43 % | ||
| A denial-of-service security issue exists in the 1719-AENTR. | A denial-of-service security issue exists in the 1719-AENTR. The security issue stems from improper handling of a UDP unicast network storm, which causes the device to become overloaded and lose communication. A power cycle is required to recover. |
Obserwuj | 8,7 | 0,43 % | ||
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2… | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that, under certain conditions could have allowed an authenticated user to perform unauthorized actions on behalf of another user by creating wiki pages with… |
Obserwuj | 8,7 | 0,43 % | ||
| Błąd eskalacji uprawnień w FreeIPA pozwala na podszywanie się pod uprzywilejowane usługi. | Błąd eskalacji uprawnień w FreeIPA pozwala na podszywanie się pod uprzywilejowane usługi. |
Obserwuj | 8,7 | 0,43 % | ||
| Luka w Oracle Unified Directory pozwala na nieautoryzowane modyfikacje danych i ataki DoS. | Luka w Oracle Unified Directory pozwala na nieautoryzowane modyfikacje danych i ataki DoS. |
Obserwuj | 8,7 | 0,43 % | ||
| ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other… | ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} or the knowledgebaseId parameter of… |
Obserwuj | 8,7 | 0,43 % | ||
| Wykrycie wskaźnika NULL w FreeRDP prowadzi do awarii procesu klienta przy emulacji karty inteligentnej. | Wykrycie wskaźnika NULL w FreeRDP prowadzi do awarii procesu klienta przy emulacji karty inteligentnej. |
Obserwuj | 8,7 | 0,43 % | ||
| Podatność na podwójne zwolnienie w open-iscsi pozwala nieautoryzowanemu atakującemu na DoS. | Podatność na podwójne zwolnienie w open-iscsi pozwala nieautoryzowanemu atakującemu na DoS. |
Obserwuj | 8,7 | 0,43 % | ||
| Brak limitu na liczbę pętli w AutoGPT prowadzi do wyczerpania przestrzeni dyskowej i DoS. | Brak limitu na liczbę pętli w AutoGPT prowadzi do wyczerpania przestrzeni dyskowej i DoS. |
Obserwuj | 8,7 | 0,43 % | ||
| IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a… | IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last() to extract… |
Obserwuj | 8,7 | 0,43 % | ||
| IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num… | IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract… |
Obserwuj | 8,7 | 0,43 % | ||
| An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus. | An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus. |
Obserwuj | 8,7 | 0,42 % | ||
| Console is a network used to control Gorilla Tag mods' users and other users on the network. | Console is a network used to control Gorilla Tag mods' users and other users on the network. Prior to version 2.8.0, a path traversal vulnerability exists where complicated combinations of backslashes and periods can be used to escape the Gorilla Tag path and write to unwanted directories. This… |
Obserwuj | 8,7 | 0,42 % | ||
| SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by… | SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the… |
Obserwuj | 8,7 | 0,42 % | ||
| LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote… | LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in… |
Obserwuj | 8,7 | 0,42 % | ||
| SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full… | SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and… |
Obserwuj | 8,7 | 0,42 % | ||
| In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. | In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in `MessageBuffer::computeRequiredCapacity()` causes the receiving… |
Obserwuj | 8,7 | 0,42 % | ||
| Brak weryfikacji URI w MRBS pozwala na nieautoryzowane pobieranie zasobów. | Brak weryfikacji URI w MRBS pozwala na nieautoryzowane pobieranie zasobów. |
Obserwuj | 8,7 | 0,42 % | ||
| Brak uwierzytelnienia w Hospital Manager Backend Services pozwala na ujawnienie wrażliwych danych. | Brak uwierzytelnienia w Hospital Manager Backend Services pozwala na ujawnienie wrażliwych danych. |
Obserwuj | 8,7 | 0,42 % | ||
| A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with… |
Obserwuj | 8,7 | 0,42 % | ||
| A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the… |
Obserwuj | 8,7 | 0,42 % | ||
| A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary… |
Obserwuj | 8,7 | 0,42 % | ||
| Luka XSS w Adobe Connect pozwala na eskalację uprawnień przez złośliwe skrypty. | Luka XSS w Adobe Connect pozwala na eskalację uprawnień przez złośliwe skrypty. |
Obserwuj | 8,7 | 0,42 % | ||
| Luka umożliwiająca nieautoryzowanemu atakującemu odczyt dowolnych plików z hosta pozwala na eskalację uprawnień. | Luka umożliwiająca nieautoryzowanemu atakującemu odczyt dowolnych plików z hosta pozwala na eskalację uprawnień. |
Obserwuj | 8,7 | 0,42 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.