Podatności

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. From version 2023.07 through version 2026.07, nanocoap_fileserver callers in sys/net/application_layer/nanocoap/fileserver.c ignore a failure returned by _resp_init() when…

CVSS 7,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.

CVSS 7,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service

CVSS 7,5 · EPSS 0,33 % · rekomendacja wg zapisanej polityki

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a buffer overflow.

CVSS 7,5 · EPSS 0,33 % · rekomendacja wg zapisanej polityki

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass authentication due to improper authentication.

CVSS 7,5 · EPSS 0,33 % · rekomendacja wg zapisanej polityki

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass security restrictions due to improper authentication.

CVSS 7,5 · EPSS 0,33 % · rekomendacja wg zapisanej polityki

IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. An unauthenticated attacker could exploit this vulnerability to write arbitrary files to the Collector.

CVSS 7,5 · EPSS 0,33 % · rekomendacja wg zapisanej polityki

IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the edge-controller gRPC service can provide malformed task data that triggers an unchecked type assertion, causing the…

CVSS 7,5 · EPSS 0,33 % · rekomendacja wg zapisanej polityki

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper bounds checking.

CVSS 7,5 · EPSS 0,33 % · rekomendacja wg zapisanej polityki

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to out-of-bounds memory access caused by a strict-weak-ordering violation in a sorting comparator.

CVSS 7,5 · EPSS 0,33 % · rekomendacja wg zapisanej polityki

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper memoization of GraphQL fragment spreads.

CVSS 7,5 · EPSS 0,33 % · rekomendacja wg zapisanej polityki

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting…

CVSS 7,5 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure.

CVSS 7,5 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a heap buffer underwrite and potentially crash the service.

CVSS 7,5 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful…

CVSS 7,5 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

CVSS 7,5 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit customers' ability to detect and investigate unauthorized access or credential misuse.

CVSS 7,5 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server…

CVSS 7,5 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

CVSS 7,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion.

CVSS 7,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames, resulting in termination of the host process.

CVSS 7,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.

CVSS 7,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when processing certain inputs.

CVSS 7,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.

CVSS 7,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

CVSS 7,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki