KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, while the public project invitation join endpoint accepts an invitation based only on a submitted email…
Wykorzystanie `ENTITY_RESOLUTION_ALLOWLIST` w GeoServer umożliwia atakującemu przeprowadzenie SSRF.
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, if an arbitrary path is specified in the request body's `fs_path`, the server serializes the Flow object into JSON and creates/overwrites a file at that path. There is no path restriction,…
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to…
Błąd w FreeIPA pozwala nieuprzywilejowanemu użytkownikowi na nieautoryzowaną modyfikację danych w LDAP.
Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted MD5 digests in user_info.password. Attackers who obtain the password column through a database leak or backup exposure…
X-AnyLabeling's model downloader disabled TLS certificate verification. download_with_retry in anylabeling/services/auto_labeling/model.py built a context with ssl._create_unverified_context() and passed it to urllib.request.urlopen, so neither the certificate chain nor the hostname was checked on…
XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component.
Błąd w Node.js przy przetwarzaniu `HTTP/2 HEADERS` może prowadzić do awarii aplikacji.
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Błąd odczytu poza granicami w RTI Connext Micro umożliwia nadmierny odczyt buforów.
Wykorzystanie luki w routerze Neterbit NW-431F umożliwia zdalne uzyskanie informacji i wykonanie kodu.
Wstrzyknięcie SQL w AiOPMSD umożliwia nieautoryzowanym atakującym dostęp do wrażliwych danych.
Wstrzyknięcie SQL w AiOPMSD umożliwia nieautoryzowanym atakującym dostęp do wrażliwych danych.
Zanieczyszczenie prototypu w form-data-objectizer pozwala na modyfikację Object.prototype.
Przepełnienie bufora w Rsync umożliwia ujawnienie poufnych danych z pamięci procesu.
Wtyczka WordPress Survey & Poll umożliwia SQL injection, co pozwala na kradzież danych z bazy.
Wstrzyknięcie SQL w TMD Vendor System umożliwia nieautoryzowanym atakującym wyciek danych z bazy.
Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL:…
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.13-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of…
Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Engineering.…
Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this…
In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the…
A vulnerability in the file upload at bookmark + asset rendering pipeline allows an attacker to upload a malicious SVG file with JavaScript content. When an authenticated admin user views the SVG file with embedded JavaScript code of shared bookmark, JavaScript executes in the admin’s browser,…
Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Plane is an open-source project management tool. | Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, while the public project invitation join endpoint accepts an invitation based only on a submitted email… |
Obserwuj | 8,2 | 0,29 % | ||
| Wykorzystanie `ENTITY_RESOLUTION_ALLOWLIST` w GeoServer umożliwia atakującemu przeprowadzenie SSRF. | Wykorzystanie `ENTITY_RESOLUTION_ALLOWLIST` w GeoServer umożliwia atakującemu przeprowadzenie SSRF. |
Obserwuj | 8,2 | 0,29 % | ||
| Langflow is a tool for building and deploying AI-powered agents and workflows. | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, if an arbitrary path is specified in the request body's `fs_path`, the server serializes the Flow object into JSON and creates/overwrites a file at that path. There is no path restriction,… |
Obserwuj | 7,1 | 5,79 % | ||
| Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality… | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to… |
Obserwuj | 8,2 | 0,29 % | ||
| Błąd w FreeIPA pozwala nieuprzywilejowanemu użytkownikowi na nieautoryzowaną modyfikację danych w LDAP. | Błąd w FreeIPA pozwala nieuprzywilejowanemu użytkownikowi na nieautoryzowaną modyfikację danych w LDAP. |
Obserwuj | 8,2 | 0,29 % | ||
| Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because… | Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted MD5 digests in user_info.password. Attackers who obtain the password column through a database leak or backup exposure… |
Obserwuj | 8,2 | 0,28 % | ||
| X-AnyLabeling's model downloader disabled TLS certificate verification. | X-AnyLabeling's model downloader disabled TLS certificate verification. download_with_retry in anylabeling/services/auto_labeling/model.py built a context with ssl._create_unverified_context() and passed it to urllib.request.urlopen, so neither the certificate chain nor the hostname was checked on… |
Obserwuj | 8,2 | 0,28 % | ||
| XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page… | XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component. |
Obserwuj | 8,2 | 0,28 % | ||
| Błąd w Node.js przy przetwarzaniu `HTTP/2 HEADERS` może prowadzić do awarii aplikacji. | Błąd w Node.js przy przetwarzaniu `HTTP/2 HEADERS` może prowadzić do awarii aplikacji. |
Obserwuj | 7,5 | 3,78 % | ||
| Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle… |
Obserwuj | 8,2 | 0,28 % | ||
| Błąd odczytu poza granicami w RTI Connext Micro umożliwia nadmierny odczyt buforów. | Błąd odczytu poza granicami w RTI Connext Micro umożliwia nadmierny odczyt buforów. |
Obserwuj | 8,2 | 0,28 % | ||
| Wykorzystanie luki w routerze Neterbit NW-431F umożliwia zdalne uzyskanie informacji i wykonanie kodu. | Wykorzystanie luki w routerze Neterbit NW-431F umożliwia zdalne uzyskanie informacji i wykonanie kodu. |
Obserwuj | 8,2 | 0,28 % | ||
| Wstrzyknięcie SQL w AiOPMSD umożliwia nieautoryzowanym atakującym dostęp do wrażliwych danych. | Wstrzyknięcie SQL w AiOPMSD umożliwia nieautoryzowanym atakującym dostęp do wrażliwych danych. |
Obserwuj | 8,2 | 0,28 % | ||
| Wstrzyknięcie SQL w AiOPMSD umożliwia nieautoryzowanym atakującym dostęp do wrażliwych danych. | Wstrzyknięcie SQL w AiOPMSD umożliwia nieautoryzowanym atakującym dostęp do wrażliwych danych. |
Obserwuj | 8,2 | 0,28 % | ||
| Zanieczyszczenie prototypu w form-data-objectizer pozwala na modyfikację Object.prototype. | Zanieczyszczenie prototypu w form-data-objectizer pozwala na modyfikację Object.prototype. |
Obserwuj | 8,2 | 0,28 % | ||
| Przepełnienie bufora w Rsync umożliwia ujawnienie poufnych danych z pamięci procesu. | Przepełnienie bufora w Rsync umożliwia ujawnienie poufnych danych z pamięci procesu. |
Obserwuj | 8,1 | 0,78 % | ||
| Wtyczka WordPress Survey & Poll umożliwia SQL injection, co pozwala na kradzież danych z bazy. | Wtyczka WordPress Survey & Poll umożliwia SQL injection, co pozwala na kradzież danych z bazy. |
Obserwuj | 8,2 | 0,28 % | ||
| Wstrzyknięcie SQL w TMD Vendor System umożliwia nieautoryzowanym atakującym wyciek danych z bazy. | Wstrzyknięcie SQL w TMD Vendor System umożliwia nieautoryzowanym atakującym wyciek danych z bazy. |
Obserwuj | 8,2 | 0,28 % | ||
| Symbolic name not mapping to correct class. | Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL:… |
Obserwuj | 8,2 | 0,28 % | ||
| Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). | Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.13-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of… |
Obserwuj | 8,2 | 0,28 % | ||
| Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Internal Operations). | Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Engineering.… |
Obserwuj | 8,2 | 0,28 % | ||
| Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability. | Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this… |
Obserwuj | 8,1 | 0,78 % | ||
| In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the… | In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the… |
Obserwuj | 8,2 | 0,28 % | ||
| A vulnerability in the file upload at bookmark + asset rendering pipeline allows an attacker to upload a malicious SVG file with… | A vulnerability in the file upload at bookmark + asset rendering pipeline allows an attacker to upload a malicious SVG file with JavaScript content. When an authenticated admin user views the SVG file with embedded JavaScript code of shared bookmark, JavaScript executes in the admin’s browser,… |
Obserwuj | 8,2 | 0,28 % | ||
| Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator:… | Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3. |
Obserwuj | 8,2 | 0,28 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.