Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames,…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML(...,…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the network to intercept and potentially manipulate communication requests between the inverter and its cloud endpoint.
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,07 % · rekomendacja wg zapisanej polityki
The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
Bypass vulnerability in the authentication method in the GTT Tax Information System application, related to the Active Directory (LDAP) login method.
Authentication is performed through a local WebSocket, but the web application does not properly validate the authenticity or origin of the data…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,56 % · rekomendacja wg zapisanej polityki
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,56 % · rekomendacja wg zapisanej polityki
@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames,…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML(...,…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the network to intercept and potentially manipulate communication requests between the inverter and its cloud endpoint.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,07 % · rekomendacja wg zapisanej polityki
The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
Bypass vulnerability in the authentication method in the GTT Tax Information System application, related to the Active Directory (LDAP) login method.
Authentication is performed through a local WebSocket, but the web application does not properly validate the authenticity or origin of the data…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,56 % · rekomendacja wg zapisanej polityki
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,56 % · rekomendacja wg zapisanej polityki