Podatności

HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted include_info values to the /api/locations/list endpoint. Attackers can place subqueries in include_info, which PlantsModel::getSpecificInfo() concatenates…

CVSS 7,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a denial of service and l2cpd restart via FNP-enabled Layer 2 interfaces. The issue is triggered when the FNP feature is…

CVSS 7,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast…

CVSS 7,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon and disclose limited process memory via a specific CFM Message sent to a configured interface.

CVSS 7,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits.

CVSS 7,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial…

CVSS 7,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data…

CVSS 7,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their assigned role permits.

CVSS 7,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits.

CVSS 7,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned…

CVSS 7,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation information beyond what…

CVSS 7,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role permits.

CVSS 7,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond their permitted role.

CVSS 7,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role…

CVSS 7,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their assigned role permits.

CVSS 7,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view.

CVSS 7,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record. Attackers can use PATCH copy or move operations to copy hidden fields into…

CVSS 7,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since…

CVSS 7,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/{guid} route with…

CVSS 7,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

A Reachable Assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service by restarting the daemon via crafted BFD session traffic.

CVSS 7,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may impersonate the authenticated NGINX…

CVSS 7,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRP_MJ_READ or IRP_MJ_WRITE before create or after close, causing CommReadFile or CommWriteFile to…

CVSS 7,1 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service.

CVSS 7,1 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service via a crafted RSVP packet when L2 LSP support is enabled.

CVSS 7,1 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens, so distinct folders such as team/docs and team-docs can share one…

CVSS 7,1 · EPSS 0,25 % · rekomendacja wg zapisanej polityki