Podatności

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql…

CVSS 7,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can modify inference_information.json can point it at a…

CVSS 7,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

CVSS 7,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() in mt.c passed the constructed command…

CVSS 7,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator…

CVSS 7,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the…

CVSS 7,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the…

CVSS 7,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

Unrestricted upload of file with dangerous type vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files. This issue affects eimzamip: from v1.6.4 before v1.6.6.

CVSS 7,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki

Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that…

CVSS 7,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object.…

CVSS 7,2 · EPSS 0,64 % · rekomendacja wg zapisanej polityki

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash…

CVSS 7,3 · EPSS 0,14 % · rekomendacja wg zapisanej polityki

NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.

CVSS 7,3 · EPSS 0,14 % · rekomendacja wg zapisanej polityki

Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory,…

CVSS 7,3 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with…

CVSS 7,3 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, information disclosure, and data tampering.

CVSS 7,3 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability mighty lead to information disclosure, data tampering, and denial of service.

CVSS 7,3 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device.

CVSS 7,3 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability might lead to information disclosure and denial of service.

CVSS 7,3 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer…

CVSS 7,3 · EPSS 0,08 % · rekomendacja wg zapisanej polityki

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.

CVSS 7,2 · EPSS 0,52 % · rekomendacja wg zapisanej polityki

The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for…

CVSS 7,3 · rekomendacja wg zapisanej polityki

A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the…

CVSS 7,3 · rekomendacja wg zapisanej polityki

A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxy_offer/rtpproxy_answer of the component rtpproxy. This manipulation causes out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 and 4.0.2 is sufficient to…

CVSS 7,3 · rekomendacja wg zapisanej polityki

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes…

CVSS 7,3 · rekomendacja wg zapisanej polityki

A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argument sort causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could…

CVSS 7,3 · rekomendacja wg zapisanej polityki