Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.
Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.
- CVSS
- 8,1
- EPSS
- 0,35 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
KATALOG INFORMACJI
Podatności
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Filtry katalogu · zakres, producent, rekomendacja
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes…
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3.
- CVSS
- 8,1
- EPSS
- 0,34 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Homer is open source telecom observability software.
Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user…
- CVSS
- 8,1
- EPSS
- 0,34 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The…
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux thevoux-wp allows PHP Local File Inclusion.This issue affects The Voux: from n/a through 6.9.5.
- CVSS
- 8,1
- EPSS
- 0,34 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Subscriber Broken Access Control in Wordable <= 8.2.10 versions.
Subscriber Broken Access Control in Wordable <= 8.2.10 versions.
- CVSS
- 8,1
- EPSS
- 0,33 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they…
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint. The endpoint fails to verify…
- CVSS
- 8,1
- EPSS
- 0,33 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper…
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command ('Code Injection'), aka improper control of code generation.
- CVSS
- 8,1
- EPSS
- 0,3 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper…
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
- CVSS
- 8,1
- EPSS
- 0,3 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to…
UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId. Attackers can send requests to DELETE /v1/appspace/app with guessed sequential…
- CVSS
- 8,1
- EPSS
- 0,29 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the…
Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
- CVSS
- 8,1
- EPSS
- 0,29 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.
Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.
- CVSS
- 8,1
- EPSS
- 0,28 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.
Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.
- CVSS
- 8,1
- EPSS
- 0,28 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.
Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.
- CVSS
- 8,1
- EPSS
- 0,28 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.
Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.
- CVSS
- 8,1
- EPSS
- 0,28 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.
Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.
- CVSS
- 8,1
- EPSS
- 0,28 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.
Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.
- CVSS
- 8,1
- EPSS
- 0,28 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
- CVSS
- 8,1
- EPSS
- 0,28 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Backstage is an open framework for building developer portals.
Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits…
- CVSS
- 8,1
- EPSS
- 0,28 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
A flaw was found in Candlepin.
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can…
- CVSS
- 8,1
- EPSS
- 0,28 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are…
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the * /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop *…
- CVSS
- 8,1
- EPSS
- 0,28 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to…
Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the long_lived_access_token scope and lure a user to an authorization…
- CVSS
- 8,1
- EPSS
- 0,27 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Vikunja is an open-source self-hosted task management platform.
Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange the code at `POST /api/v1/oauth/token` for a normal bearer JSON…
- CVSS
- 8,1
- EPSS
- 0,27 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access,…
Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their…
- CVSS
- 8,1
- EPSS
- 0,26 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.
Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.
- CVSS
- 8,1
- EPSS
- 0,26 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing…
LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow template name.
- CVSS
- 8,1
- EPSS
- 0,26 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions. | Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes… | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3. |
Obserwuj | 8,1 | 0,34 % | ||
| Homer is open source telecom observability software. | Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user… |
Obserwuj | 8,1 | 0,34 % | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The… | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux thevoux-wp allows PHP Local File Inclusion.This issue affects The Voux: from n/a through 6.9.5. |
Obserwuj | 8,1 | 0,34 % | ||
| Subscriber Broken Access Control in Wordable <= 8.2.10 versions. | Subscriber Broken Access Control in Wordable <= 8.2.10 versions. |
Obserwuj | 8,1 | 0,33 % | ||
| An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they… | An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint. The endpoint fails to verify… |
Obserwuj | 8,1 | 0,33 % | ||
| IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper… | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command ('Code Injection'), aka improper control of code generation. |
Obserwuj | 8,1 | 0,3 % | ||
| IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper… | IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command. |
Obserwuj | 8,1 | 0,3 % | ||
| UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to… | UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId. Attackers can send requests to DELETE /v1/appspace/app with guessed sequential… |
Obserwuj | 8,1 | 0,29 % | ||
| Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the… | Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
Obserwuj | 8,1 | 0,29 % | ||
| Unauthenticated Local File Inclusion in Ambient <= 1.7 versions. | Unauthenticated Local File Inclusion in Ambient <= 1.7 versions. |
Obserwuj | 8,1 | 0,28 % | ||
| Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions. | Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions. |
Obserwuj | 8,1 | 0,28 % | ||
| Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions. | Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions. |
Obserwuj | 8,1 | 0,28 % | ||
| Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions. | Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions. |
Obserwuj | 8,1 | 0,28 % | ||
| Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions. | Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions. |
Obserwuj | 8,1 | 0,28 % | ||
| Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions. | Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions. |
Obserwuj | 8,1 | 0,28 % | ||
| Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions. | Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions. |
Obserwuj | 8,1 | 0,28 % | ||
| Backstage is an open framework for building developer portals. | Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits… |
Obserwuj | 8,1 | 0,28 % | ||
| A flaw was found in Candlepin. | A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can… |
Obserwuj | 8,1 | 0,28 % | ||
| An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are… | An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the * /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop *… |
Obserwuj | 8,1 | 0,28 % | ||
| Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to… | Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the long_lived_access_token scope and lure a user to an authorization… |
Obserwuj | 8,1 | 0,27 % | ||
| Vikunja is an open-source self-hosted task management platform. | Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange the code at `POST /api/v1/oauth/token` for a normal bearer JSON… |
Obserwuj | 8,1 | 0,27 % | ||
| Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access,… | Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their… |
Obserwuj | 8,1 | 0,26 % | ||
| Unauthenticated PHP Object Injection in Haaken <= 1.5 versions. | Unauthenticated PHP Object Injection in Haaken <= 1.5 versions. |
Obserwuj | 8,1 | 0,26 % | ||
| LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing… | LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow template name. |
Obserwuj | 8,1 | 0,26 % |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOstatnie przetworzenie zakończone
NVD · aktualizacjeOstatnie przetworzenie zakończone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOstatnie przetworzenie zakończoneData modelu znajduje się przy rekordzie.