KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Luka w Winter CMS umożliwia zdalne wykonanie kodu przez użytkowników z uprawnieniami do edycji szablonów.
Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1.
BASIS BBj versions prior to 25.00 contain a Jetty-served web endpoint that fails to properly validate or canonicalize input path segments. This allows unauthenticated directory traversal sequences to cause the server to read arbitrary system files accessible to the account running the service.…
A SQL Injection vulnerability on an endpoint in BEIMS Contractor Web, a legacy product that is no longer maintained or patched by the vendor, allows an unauthorised user to retrieve sensitive database contents via unsanitized parameter input. This vulnerability occurs due to improper input…
Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute…
SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf.Api.Token) via an Authorization header (Token/Bearer) or a ?token= query parameter, and neither path is…
SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the…
Zbtlink router firmware zawiera implant zdalnego sterowania, umożliwiający nieautoryzowane wykonanie kodu.
Brak uwierzytelnienia w AMMOS Instrument Toolkit umożliwia zdalne wydawanie poleceń statkom kosmicznym.
A malicious actor can access camera configuration information, including account credentials, without authenticating when accessing a vulnerable URL.
A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has…
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/host_access_delay.lua.
Obejście uwierzytelnienia w rConfig umożliwia nieautoryzowanym atakującym rejestrację konta z uprawnieniami Administratora.
A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit…
LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded __import__,…
Wstrzyknięcie SQL w PyAthena umożliwia nieautoryzowanym atakującym wyciek danych i wykonanie destrukcyjnych poleceń.
Luka w Nuvation Energy nCloud VPN Service umożliwia mostkowanie granic sieci.
Brak uwierzytelnienia w urządzeniach WAGO System I/O Field umożliwia zdalne przejęcie systemu.
Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root.
Brak odpowiedniej sanitacji w PROCON-WEB SCADA umożliwia zdalne wykonanie dowolnych poleceń SQL.
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,…
An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface.
Brak współdzielonego limitera w OpenSSL pozwala na obejście ochrony przed atakami TOTP.
Obejście uwierzytelnienia w aplikacji VINE umożliwia dostęp do danych innych użytkowników.
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Luka w Winter CMS umożliwia zdalne wykonanie kodu przez użytkowników z uprawnieniami do edycji szablonów. | Luka w Winter CMS umożliwia zdalne wykonanie kodu przez użytkowników z uprawnieniami do edycji szablonów. |
W tym tygodniu | 9,3 | 0,81 % | ||
| Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability… | Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1. |
W tym tygodniu | 9,4 | 0,31 % | ||
| BASIS BBj versions prior to 25.00 contain a Jetty-served web endpoint that fails to properly validate or canonicalize input path segments. | BASIS BBj versions prior to 25.00 contain a Jetty-served web endpoint that fails to properly validate or canonicalize input path segments. This allows unauthenticated directory traversal sequences to cause the server to read arbitrary system files accessible to the account running the service.… |
W tym tygodniu | 9,3 | 0,81 % | ||
| A SQL Injection vulnerability on an endpoint in BEIMS Contractor Web, a legacy product that is no longer maintained or patched by the… | A SQL Injection vulnerability on an endpoint in BEIMS Contractor Web, a legacy product that is no longer maintained or patched by the vendor, allows an unauthorised user to retrieve sensitive database contents via unsanitized parameter input. This vulnerability occurs due to improper input… |
W tym tygodniu | 9,4 | 0,3 % | ||
| Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write… | Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute… |
W tym tygodniu | 9,3 | 0,8 % | ||
| SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth()… | SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf.Api.Token) via an Authorization header (Token/Bearer) or a ?token= query parameter, and neither path is… |
W tym tygodniu | 9,3 | 0,79 % | ||
| SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. | SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the… |
W tym tygodniu | 9,3 | 0,79 % | ||
| Zbtlink router firmware zawiera implant zdalnego sterowania, umożliwiający nieautoryzowane wykonanie kodu. | Zbtlink router firmware zawiera implant zdalnego sterowania, umożliwiający nieautoryzowane wykonanie kodu. |
W tym tygodniu | 9,3 | 0,79 % | ||
| Brak uwierzytelnienia w AMMOS Instrument Toolkit umożliwia zdalne wydawanie poleceń statkom kosmicznym. | Brak uwierzytelnienia w AMMOS Instrument Toolkit umożliwia zdalne wydawanie poleceń statkom kosmicznym. |
W tym tygodniu | 9,3 | 0,79 % | ||
| A malicious actor can access camera configuration information, including account credentials, without authenticating when accessing a… | A malicious actor can access camera configuration information, including account credentials, without authenticating when accessing a vulnerable URL. |
W tym tygodniu | 9,3 | 0,78 % | ||
| A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. | A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has… |
W tym tygodniu | 9,3 | 0,78 % | ||
| OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted… | OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/host_access_delay.lua. |
W tym tygodniu | 8,8 | 3,27 % | ||
| Obejście uwierzytelnienia w rConfig umożliwia nieautoryzowanym atakującym rejestrację konta z uprawnieniami Administratora. | Obejście uwierzytelnienia w rConfig umożliwia nieautoryzowanym atakującym rejestrację konta z uprawnieniami Administratora. |
W tym tygodniu | 9,3 | 0,77 % | ||
| A vulnerability has been found in InternLM MindSearch 0.1.0. | A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit… |
W tym tygodniu | 9,3 | 0,77 % | ||
| LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code… | LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded __import__,… |
W tym tygodniu | 9,3 | 0,77 % | ||
| Wstrzyknięcie SQL w PyAthena umożliwia nieautoryzowanym atakującym wyciek danych i wykonanie destrukcyjnych poleceń. | Wstrzyknięcie SQL w PyAthena umożliwia nieautoryzowanym atakującym wyciek danych i wykonanie destrukcyjnych poleceń. |
W tym tygodniu | 9,3 | 0,77 % | ||
| Luka w Nuvation Energy nCloud VPN Service umożliwia mostkowanie granic sieci. | Luka w Nuvation Energy nCloud VPN Service umożliwia mostkowanie granic sieci. |
W tym tygodniu | 9,4 | 0,26 % | ||
| Brak uwierzytelnienia w urządzeniach WAGO System I/O Field umożliwia zdalne przejęcie systemu. | Brak uwierzytelnienia w urządzeniach WAGO System I/O Field umożliwia zdalne przejęcie systemu. |
W tym tygodniu | 9,3 | 0,76 % | ||
| Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system… | Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root. |
W tym tygodniu | 9,3 | 0,75 % | ||
| Brak odpowiedniej sanitacji w PROCON-WEB SCADA umożliwia zdalne wykonanie dowolnych poleceń SQL. | Brak odpowiedniej sanitacji w PROCON-WEB SCADA umożliwia zdalne wykonanie dowolnych poleceń SQL. |
W tym tygodniu | 9,3 | 0,75 % | ||
| Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious… | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,… |
W tym tygodniu | 9,3 | 0,75 % | ||
| An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated… | An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface. |
W tym tygodniu | 9,3 | 0,75 % | ||
| Brak współdzielonego limitera w OpenSSL pozwala na obejście ochrony przed atakami TOTP. | Brak współdzielonego limitera w OpenSSL pozwala na obejście ochrony przed atakami TOTP. |
W tym tygodniu | 9,3 | 0,75 % | ||
| Obejście uwierzytelnienia w aplikacji VINE umożliwia dostęp do danych innych użytkowników. | Obejście uwierzytelnienia w aplikacji VINE umożliwia dostęp do danych innych użytkowników. |
W tym tygodniu | 9,3 | 0,75 % | ||
| On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the… | On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a… |
W tym tygodniu | 9,4 | 0,25 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.