Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.
A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope.
What DESTROY does depends on…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.The function `grayscale_convert` is called…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's `boring-tls` integration silently disables TLS hostname verification for callers using the default (strict) configuration. An on-path attacker presenting any…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.
A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope.
What DESTROY does depends on…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.The function `grayscale_convert` is called…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's `boring-tls` integration silently disables TLS hostname verification for callers using the default (strict) configuration. An on-path attacker presenting any…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki