Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service (stack exhaustion and process crash) via a DICOM dataset containing deeply nested sequences (SQ elements). The…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer,…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member.…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Student Learning Assessment and Support System developed by JHENG GAO has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a specific page and obtain test accounts and password.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. While…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be readvertised to cause an rpd crash.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service (stack exhaustion and process crash) via a DICOM dataset containing deeply nested sequences (SQ elements). The…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Student Learning Assessment and Support System developed by JHENG GAO has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a specific page and obtain test accounts and password.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. While…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be readvertised to cause an rpd crash.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,38 % · rekomendacja wg zapisanej polityki