KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Niewystarczająca walidacja danych w BFCache w Google Chrome umożliwia zdalne obejście piaskownicy.
MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.
Wersje OpenSSL przed 1.4.0 ujawniają hasła w argumentach procesu, co pozwala na ich odczyt przez atakujących.
Brak ograniczeń w alokacji zasobów w Qt może prowadzić do zablokowania aplikacji.
PJSIP is a free and open source multimedia communication library. Prior to version 2.16, Opus PLC may zero-fill the input frame as long as the decoder ptime, while the input frame length, which is based on stream ptime, may be less than that. This issue affects PJSIP users who use the Opus audio…
The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system.
Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 (secret/private) projects they were never invited to and grants them a full Member role (read + write).…
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=user_mention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member.…
A lack of authentication in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to the device's internal Wi-Fi network to gain unrestricted access to the web administration interface and the HTTP API. Due to the lack of authorization…
Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through 4.4.2 contain a flaw in path handling which could allow an attacker to access protected API endpoints by sending a crafted request path. An unauthenticated or unauthorized…
GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=<path>, causing cloning…
Wtyczka LoginControl w WWBN AVideo umożliwia atak XSS przez złośliwe nagłówki User-Agent.
On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code…
Lynx+ Gateway jest podatny na przesyłanie danych w postaci niezaszyfrowanej, co umożliwia kradzież haseł.
Wykorzystanie podatności w dekodowaniu JPX w Popplerze prowadzi do ataku typu DoS.
Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c.
Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'Address.php' file. Fixed in 123c97c.
Błędy implementacji kryptograficznej w libcrux-ecdh, libcrux-ed25519 i libcrux-psq mogą prowadzić do osłabienia bezpieczeństwa.
pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed…
Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_project_view_export). The authorization guards are attached to the sibling __invoke method rather than at the class level, so the export route inherits no authorization checks. Any…
Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method…
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with…
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common…
Niedostateczna lista zablokowanych elementów w Grav pozwala na ujawnienie tajnych wartości konfiguracyjnych.
Przepełnienie bufora w Edimax EW-7478APC umożliwia zdalne wykonanie kodu.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Niewystarczająca walidacja danych w BFCache w Google Chrome umożliwia zdalne obejście piaskownicy. | Niewystarczająca walidacja danych w BFCache w Google Chrome umożliwia zdalne obejście piaskownicy. |
Obserwuj | 8,7 | 0,32 % | ||
| MediaAgent contained a heap-based buffer overflow issue affecting service availability. | MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale. |
Obserwuj | 8,7 | 0,32 % | ||
| Wersje OpenSSL przed 1.4.0 ujawniają hasła w argumentach procesu, co pozwala na ich odczyt przez atakujących. | Wersje OpenSSL przed 1.4.0 ujawniają hasła w argumentach procesu, co pozwala na ich odczyt przez atakujących. |
Obserwuj | 8,7 | 0,32 % | ||
| Brak ograniczeń w alokacji zasobów w Qt może prowadzić do zablokowania aplikacji. | Brak ograniczeń w alokacji zasobów w Qt może prowadzić do zablokowania aplikacji. |
Obserwuj | 8,7 | 0,32 % | ||
| PJSIP is a free and open source multimedia communication library. | PJSIP is a free and open source multimedia communication library. Prior to version 2.16, Opus PLC may zero-fill the input frame as long as the decoder ptime, while the input frame length, which is based on stream ptime, may be less than that. This issue affects PJSIP users who use the Opus audio… |
Obserwuj | 8,7 | 0,32 % | ||
| The internal data publisher on openPDC accepts network connections without authentication in its default configuration. | The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system. |
Obserwuj | 8,7 | 0,31 % | ||
| Plane is an open-source project management tool. | Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 (secret/private) projects they were never invited to and grants them a full Member role (read + write).… |
Obserwuj | 8,7 | 0,31 % | ||
| Plane is an open-source project management tool. | Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=user_mention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member.… |
Obserwuj | 8,7 | 0,31 % | ||
| A lack of authentication in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected… | A lack of authentication in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to the device's internal Wi-Fi network to gain unrestricted access to the web administration interface and the HTTP API. Due to the lack of authorization… |
Obserwuj | 8,7 | 0,31 % | ||
| Form.io is a combined Form and API platform for Serverless applications. | Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through 4.4.2 contain a flaw in path handling which could allow an attacker to access protected API endpoints by sending a crafted request path. An unauthenticated or unauthorized… |
Obserwuj | 8,7 | 0,31 % | ||
| GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary… | GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=<path>, causing cloning… |
Obserwuj | 8,7 | 0,31 % | ||
| Wtyczka LoginControl w WWBN AVideo umożliwia atak XSS przez złośliwe nagłówki User-Agent. | Wtyczka LoginControl w WWBN AVideo umożliwia atak XSS przez złośliwe nagłówki User-Agent. |
Obserwuj | 8,7 | 0,31 % | ||
| On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio… | On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code… |
Obserwuj | 8,7 | 0,31 % | ||
| Lynx+ Gateway jest podatny na przesyłanie danych w postaci niezaszyfrowanej, co umożliwia kradzież haseł. | Lynx+ Gateway jest podatny na przesyłanie danych w postaci niezaszyfrowanej, co umożliwia kradzież haseł. |
Obserwuj | 8,7 | 0,31 % | ||
| Wykorzystanie podatności w dekodowaniu JPX w Popplerze prowadzi do ataku typu DoS. | Wykorzystanie podatności w dekodowaniu JPX w Popplerze prowadzi do ataku typu DoS. |
Obserwuj | 8,7 | 0,31 % | ||
| Webkul QloApps does not validate request parameters before a database query. | Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c. |
Obserwuj | 8,6 | 0,81 % | ||
| Webkul QloApps does not validate request parameters before a database query. | Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'Address.php' file. Fixed in 123c97c. |
Obserwuj | 8,6 | 0,81 % | ||
| Błędy implementacji kryptograficznej w libcrux-ecdh, libcrux-ed25519 i libcrux-psq mogą prowadzić do osłabienia bezpieczeństwa. | Błędy implementacji kryptograficznej w libcrux-ecdh, libcrux-ed25519 i libcrux-psq mogą prowadzić do osłabienia bezpieczeństwa. |
Obserwuj | 8,7 | 0,31 % | ||
| pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated… | pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed… |
Obserwuj | 8,7 | 0,31 % | ||
| Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_project_view_export). | Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_project_view_export). The authorization guards are attached to the sibling __invoke method rather than at the class level, so the export route inherits no authorization checks. Any… |
Obserwuj | 8,7 | 0,31 % | ||
| Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal… | Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method… |
Obserwuj | 8,7 | 0,31 % | ||
| Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism… | Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with… |
Obserwuj | 8,7 | 0,31 % | ||
| Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled… | Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common… |
Obserwuj | 8,7 | 0,31 % | ||
| Niedostateczna lista zablokowanych elementów w Grav pozwala na ujawnienie tajnych wartości konfiguracyjnych. | Niedostateczna lista zablokowanych elementów w Grav pozwala na ujawnienie tajnych wartości konfiguracyjnych. |
Obserwuj | 8,7 | 0,31 % | ||
| Przepełnienie bufora w Edimax EW-7478APC umożliwia zdalne wykonanie kodu. | Przepełnienie bufora w Edimax EW-7478APC umożliwia zdalne wykonanie kodu. |
Obserwuj | 8,6 | 0,8 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.