Podatności

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user…

CVSS 7,5 · EPSS 0,5 % · rekomendacja wg zapisanej polityki

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user…

CVSS 7,5 · EPSS 0,5 % · rekomendacja wg zapisanej polityki

ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.

CVSS 7,5 · EPSS 0,49 % · rekomendacja wg zapisanej polityki

EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List service. This allows a remote attacker to cause a denial of service

CVSS 7,5 · EPSS 0,48 % · rekomendacja wg zapisanej polityki

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `cart[id]` parameters on the `steps__reload_booking_form_summary_panel` and…

CVSS 7,5 · EPSS 0,48 % · rekomendacja wg zapisanej polityki

Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.

CVSS 7,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An…

CVSS 7,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki

CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not…

CVSS 7,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki

CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not…

CVSS 7,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki

CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not…

CVSS 7,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki

CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not…

CVSS 7,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki

CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

CVSS 7,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki

CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

CVSS 7,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

CVSS 7,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki

The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes…

CVSS 7,5 · EPSS 0,45 % · rekomendacja wg zapisanej polityki

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to…

CVSS 7,5 · EPSS 0,45 % · rekomendacja wg zapisanej polityki

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAK_IMPORT_PATTERN and consumed by _write_missing_weak_imports in…

CVSS 7,5 · EPSS 0,45 % · rekomendacja wg zapisanej polityki

OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to cause a denial of service.

CVSS 7,5 · EPSS 0,45 % · rekomendacja wg zapisanej polityki

EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. This allows a remote attacker to cause a denial of service.

CVSS 7,5 · EPSS 0,45 % · rekomendacja wg zapisanej polityki

An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to obtain sensitive information

CVSS 7,5 · EPSS 0,45 % · rekomendacja wg zapisanej polityki

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired…

CVSS 7,5 · EPSS 0,45 % · rekomendacja wg zapisanej polityki

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopass_http_requests_total and…

CVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki

Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated…

CVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki

A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers during ticket downloads. This could allow an attacker who can manipulate the ticket response to…

CVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki

fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer names,…

CVSS 7,5 · EPSS 0,44 % · rekomendacja wg zapisanej polityki