Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.
To mitigate this issue,…
Opis źródłowy NVD · ENCVSS 8,4 · EPSS 0,73 % · rekomendacja wg zapisanej polityki
Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parameter of the Ftps.add API. Attackers can embed newline characters that the…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration.
The specific flaw exists within the backup restoration mechanism, which…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated internal user who can execute the affected actions may cause…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
hank-ai/darknet sizes a convolutional layer's weight and output heap buffers by multiplying configuration fields taken from a .cfg file in unchecked 32-bit int arithmetic. In src-lib/convolutional_layer.cpp, l.nweights is computed as (c / groups) * n * size * size and l.outputs as l.out_h *…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UpSolution UpSolution Core us-core allows Blind SQL Injection.This issue affects UpSolution Core: from n/a through 9.3.
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms allows Blind SQL Injection.This issue affects WPLMS : from n/a through 4.973.
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child_process.exec() in index.ts, which…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.
To mitigate this issue,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,4 · EPSS 0,73 % · rekomendacja wg zapisanej polityki
Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parameter of the Ftps.add API. Attackers can embed newline characters that the…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration.
The specific flaw exists within the backup restoration mechanism, which…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated internal user who can execute the affected actions may cause…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
hank-ai/darknet sizes a convolutional layer's weight and output heap buffers by multiplying configuration fields taken from a .cfg file in unchecked 32-bit int arithmetic. In src-lib/convolutional_layer.cpp, l.nweights is computed as (c / groups) * n * size * size and l.outputs as l.out_h *…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UpSolution UpSolution Core us-core allows Blind SQL Injection.This issue affects UpSolution Core: from n/a through 9.3.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms allows Blind SQL Injection.This issue affects WPLMS : from n/a through 4.973.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child_process.exec() in index.ts, which…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki