Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account,…
Opis źródłowy NVD · ENCVSS 9,9 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.
Opis źródłowy NVD · ENCVSS 9,9 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run…
Opis źródłowy NVD · ENCVSS 9,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator with limited site permissions to make critical changes to local Morpho devices.
This issue affects Command Centre Server:
9.30 prior to…
Opis źródłowy NVD · ENCVSS 9,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account.
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 2,84 % · rekomendacja wg zapisanej polityki
Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send.
Both default emails emit a link of the form `$base/login/$code`, whose authority comes from the request…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,84 % · rekomendacja wg zapisanej polityki
pyquokka is a framework for making data lakes work for time series. In versions 0.3.1 and prior, the FlightServer class directly uses pickle.loads() to deserialize action bodies received from Flight clients without any sanitization or validation in the do_action() method. The vulnerable code is…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,84 % · rekomendacja wg zapisanej polityki
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account,…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,9 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,9 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator with limited site permissions to make critical changes to local Morpho devices.
This issue affects Command Centre Server:
9.30 prior to…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 2,84 % · rekomendacja wg zapisanej polityki
Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send.
Both default emails emit a link of the form `$base/login/$code`, whose authority comes from the request…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,84 % · rekomendacja wg zapisanej polityki
pyquokka is a framework for making data lakes work for time series. In versions 0.3.1 and prior, the FlightServer class directly uses pickle.loads() to deserialize action bodies received from Flight clients without any sanitization or validation in the do_action() method. The vulnerable code is…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,84 % · rekomendacja wg zapisanej polityki