Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action in the…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_token set to an env reference via /config/dump to read…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks.
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. Because ELOG includes usernames and password hashes in certain HTTP requests, an attacker can obtain the target's credentials and replay them or…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
This
vulnerability exists in the Netlink ICT HG323RW router due to insufficient
authorization and input validation controls in the diagnostic script import
functionality. An authenticated attacker could exploit this vulnerability by
uploading and executing a specially crafted script through the…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefore…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
A security issue exists within FactoryTalk® Historian Machine Edition. An attacker with low-level authentication could exploit this vulnerability to achieve remote code execution on the affected device.
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause server-side request forgery by supplying a crafted external key map URL. A successful exploit of this vulnerability might lead to information disclosure.
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
Smart Video Doorbell firmware versions prior to 2.01.078 contain an active debug code vulnerability that allows an attacker to connect via Telnet and gain access to the device.
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
CVSS
8,6
EPSS
0,31 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action in the…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_token set to an env reference via /config/dump to read…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. Because ELOG includes usernames and password hashes in certain HTTP requests, an attacker can obtain the target's credentials and replay them or…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
This
vulnerability exists in the Netlink ICT HG323RW router due to insufficient
authorization and input validation controls in the diagnostic script import
functionality. An authenticated attacker could exploit this vulnerability by
uploading and executing a specially crafted script through the…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefore…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
A security issue exists within FactoryTalk® Historian Machine Edition. An attacker with low-level authentication could exploit this vulnerability to achieve remote code execution on the affected device.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause server-side request forgery by supplying a crafted external key map URL. A successful exploit of this vulnerability might lead to information disclosure.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
Smart Video Doorbell firmware versions prior to 2.01.078 contain an active debug code vulnerability that allows an attacker to connect via Telnet and gain access to the device.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
8,6
0,31 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.