KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.
Moduł mod_copy w ProFTPD umożliwia zdalnym atakującym odczyt i zapis dowolnych plików.
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration.…
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro…
Błąd w protokole CMP w Cisco IOS pozwala na zdalne wykonanie kodu lub restart urządzenia.
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the…
Wykonanie złośliwego kodu zdalnie w Apache Struts przez złośliwe dane w polu wiadomości.
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
Wykorzystanie podatności w SysAid umożliwia zdalne wykonanie kodu przez atakującego.
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
Wstrzyknięcie kodu w Ivanti Endpoint Manager Mobile umożliwia zdalne wykonanie kodu bez uwierzytelnienia.
Nieograniczony upload i download plików w Cleo Harmony, VLTrader i LexiCom umożliwia zdalne wykonanie kodu.
The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP. This issue…
A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to…
An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for…
Wielokrotne podatności w Java Runtime Environment umożliwiają zdalne wykonanie kodu.
Luka w Apache ActiveMQ umożliwia zdalne przesyłanie i wykonywanie dowolnych plików.
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web…
Wykonanie kodu zdalnie w PAN-OS umożliwia atakującym wykorzystanie interfejsu zarządzania.
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not…
Luki w Netgear WN604 i innych modelach pozwalają na zdalne wykonanie dowolnych poleceń.
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a… | Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request. |
Pilne działanie | 9,8 | 99,03 % | ||
| Moduł mod_copy w ProFTPD umożliwia zdalnym atakującym odczyt i zapis dowolnych plików. | Moduł mod_copy w ProFTPD umożliwia zdalnym atakującym odczyt i zapis dowolnych plików. |
Pilne działanie | 10,0 | 98,03 % | ||
| telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. | telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. |
Pilne działanie | 9,8 | 98,98 % | ||
| smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary… | smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration.… |
Pilne działanie | 9,8 | 98,97 % | ||
| Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code… | Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution. |
Pilne działanie | 9,8 | 98,96 % | ||
| The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent… | The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro… |
Pilne działanie | 9,8 | 98,95 % | ||
| Błąd w protokole CMP w Cisco IOS pozwala na zdalne wykonanie kodu lub restart urządzenia. | Błąd w protokole CMP w Cisco IOS pozwala na zdalne wykonanie kodu lub restart urządzenia. |
Pilne działanie | 9,8 | 98,95 % | ||
| SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web… | SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the… |
Pilne działanie | 10,0 | 97,95 % | ||
| Wykonanie złośliwego kodu zdalnie w Apache Struts przez złośliwe dane w polu wiadomości. | Wykonanie złośliwego kodu zdalnie w Apache Struts przez złośliwe dane w polu wiadomości. |
Pilne działanie | 9,8 | 98,91 % | ||
| A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0… | A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older. |
Pilne działanie | 9,8 | 98,91 % | ||
| Wykorzystanie podatności w SysAid umożliwia zdalne wykonanie kodu przez atakującego. | Wykorzystanie podatności w SysAid umożliwia zdalne wykonanie kodu przez atakującego. |
Pilne działanie | 9,8 | 98,85 % | ||
| A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. | A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. |
Pilne działanie | 9,8 | 98,69 % | ||
| Wstrzyknięcie kodu w Ivanti Endpoint Manager Mobile umożliwia zdalne wykonanie kodu bez uwierzytelnienia. | Wstrzyknięcie kodu w Ivanti Endpoint Manager Mobile umożliwia zdalne wykonanie kodu bez uwierzytelnienia. |
Pilne działanie | 9,8 | 98,64 % | ||
| Nieograniczony upload i download plików w Cleo Harmony, VLTrader i LexiCom umożliwia zdalne wykonanie kodu. | Nieograniczony upload i download plików w Cleo Harmony, VLTrader i LexiCom umożliwia zdalne wykonanie kodu. |
Pilne działanie | 9,8 | 98,61 % | ||
| The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that,… | The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP. This issue… |
Pilne działanie | 10,0 | 97,6 % | ||
| A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code… | A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to… |
Pilne działanie | 10,0 | 97,6 % | ||
| An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. | An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for… |
Pilne działanie | 9,8 | 98,55 % | ||
| Wielokrotne podatności w Java Runtime Environment umożliwiają zdalne wykonanie kodu. | Wielokrotne podatności w Java Runtime Environment umożliwiają zdalne wykonanie kodu. |
Pilne działanie | 9,8 | 98,54 % | ||
| Luka w Apache ActiveMQ umożliwia zdalne przesyłanie i wykonywanie dowolnych plików. | Luka w Apache ActiveMQ umożliwia zdalne przesyłanie i wykonywanie dowolnych plików. |
Pilne działanie | 9,8 | 98,52 % | ||
| A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through… | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets. |
Pilne działanie | 9,8 | 98,45 % | ||
| Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). | Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web… |
Pilne działanie | 9,8 | 98,34 % | ||
| Wykonanie kodu zdalnie w PAN-OS umożliwia atakującym wykorzystanie interfejsu zarządzania. | Wykonanie kodu zdalnie w PAN-OS umożliwia atakującym wykorzystanie interfejsu zarządzania. |
Pilne działanie | 9,8 | 98,34 % | ||
| A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in… | A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not… |
Pilne działanie | 9,8 | 98,33 % | ||
| Luki w Netgear WN604 i innych modelach pozwalają na zdalne wykonanie dowolnych poleceń. | Luki w Netgear WN604 i innych modelach pozwalają na zdalne wykonanie dowolnych poleceń. |
Pilne działanie | 9,8 | 98,29 % | ||
| Aria Operations for Networks contains a command injection vulnerability. | Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution. |
Pilne działanie | 9,8 | 98,28 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.