Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read…
Opis źródłowy NVD · ENCVSS 8,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata…
Opis źródłowy NVD · ENCVSS 8,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No…
Opis źródłowy NVD · ENCVSS 8,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions <=4.4.0 fail to enforce authentication and issue-key path restrictions in the Jira plugin, which allows an unauthenticated attacker who…
Opis źródłowy NVD · ENCVSS 8,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
The SolisCloud API suffers from a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference (IDOR), where any authenticated user can access detailed data of any plant by altering the plant_id in the request.
Opis źródłowy NVD · ENCVSS 8,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources". A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause such links
to be loaded without prompt.
This issue affects Apache…
Opis źródłowy NVD · ENCVSS 8,1 · EPSS 1,26 % · rekomendacja wg zapisanej polityki
Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Opis źródłowy NVD · ENCVSS 8,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Opis źródłowy NVD · ENCVSS 8,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that…
Opis źródłowy NVD · ENCVSS 8,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions <=4.4.0 fail to enforce authentication and issue-key path restrictions in the Jira plugin, which allows an unauthenticated attacker who…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
The SolisCloud API suffers from a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference (IDOR), where any authenticated user can access detailed data of any plant by altering the plant_id in the request.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources". A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause such links
to be loaded without prompt.
This issue affects Apache…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,1 · EPSS 1,26 % · rekomendacja wg zapisanej polityki
Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki