Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 2,84 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-RAP2200(E) 247 2200 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 2,84 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1300G EW1300G V1.00/V2.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 2,84 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint.
Successful exploitation…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an authenticated command injection vulnerability in the license activation workflow handled by AudioCodes_files/ActivateLicense.php. When a license file is uploaded, the application derives a new…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 2,82 % · rekomendacja wg zapisanej polityki
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 2,84 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-RAP2200(E) 247 2200 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 2,84 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1300G EW1300G V1.00/V2.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 2,84 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint.
Successful exploitation…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an authenticated command injection vulnerability in the license activation workflow handled by AudioCodes_files/ActivateLicense.php. When a license file is uploaded, the application derives a new…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 2,82 % · rekomendacja wg zapisanej polityki
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki