KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.
Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over a network.
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit…
ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not…
Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.
Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker to deny service over a network.
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
Subscriber Settings Change in uListing <= 2.2.0 versions.
Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions.
A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions before 10.0.1. The vulnerability occurs when processing initial IKE key exchange requests on extension switches or blades running IPsec-enabled Fibre Channel over…
Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.
Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.
Administrator SQL Injection in Leyka <= 3.32.3 versions.
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0, generated applications can persist attacker-controlled Blob data and companion ContentType values, return…
Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change…
IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges.
LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API…
No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network. | Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network. |
Obserwuj | 7,5 | 0,88 % | ||
| Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over a network. | Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 0,87 % | ||
| pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows… | pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit… |
Obserwuj | 7,6 | 0,37 % | ||
| ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. | ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not… |
Obserwuj | 7,5 | 0,86 % | ||
| Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. | Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 0,85 % | ||
| Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network. | Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 0,83 % | ||
| Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker to deny service over a network. | Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 0,83 % | ||
| IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an… | IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw. |
Obserwuj | 7,6 | 0,33 % | ||
| Subscriber Settings Change in uListing <= 2.2.0 versions. | Subscriber Settings Change in uListing <= 2.2.0 versions. |
Obserwuj | 7,6 | 0,3 % | ||
| Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions. | Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions. |
Obserwuj | 7,6 | 0,29 % | ||
| A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions… | A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions before 10.0.1. The vulnerability occurs when processing initial IKE key exchange requests on extension switches or blades running IPsec-enabled Fibre Channel over… |
Obserwuj | 7,5 | 0,79 % | ||
| Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions. | Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions. |
Obserwuj | 7,6 | 0,28 % | ||
| Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions. | Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions. |
Obserwuj | 7,6 | 0,28 % | ||
| Administrator SQL Injection in Leyka <= 3.32.3 versions. | Administrator SQL Injection in Leyka <= 3.32.3 versions. |
Obserwuj | 7,6 | 0,28 % | ||
| Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 0,77 % | ||
| Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network. | Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 0,77 % | ||
| Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny… | Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 0,77 % | ||
| Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. | Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 0,77 % | ||
| JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. | JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0, generated applications can persist attacker-controlled Blob data and companion ContentType values, return… |
Obserwuj | 7,6 | 0,26 % | ||
| Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session… | Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change… |
Obserwuj | 7,6 | 0,25 % | ||
| IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. | IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges. |
Obserwuj | 7,2 | 2,25 % | ||
| LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port… | LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API… |
Obserwuj | 7,6 | 0,24 % | ||
| No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. |
Obserwuj | 7,5 | 0,74 % | ||
| MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to… | MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or… |
Obserwuj | 7,6 | 0,24 % | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1. |
Obserwuj | 7,6 | 0,24 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.