KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Wykorzystanie podatności w Langchain-Chatchat umożliwia atakującemu zapis plików w dowolnych lokalizacjach.
The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue…
A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters.
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Identity Manager…
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Identity Manager…
Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overwrite sensitive configuration files or place…
Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can…
Ucieczka z piaskownicy w komponencie XPConnect umożliwia zdalne wykonanie kodu.
Błąd w NewKeyring() pozwala na użycie kluczy bez potwierdzenia, co narusza bezpieczeństwo.
WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or…
Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the…
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote,…
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Nieograniczony upload niebezpiecznych plików w Contentstudio umożliwia wgranie powłoki sieciowej.
Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an attacker already possesses a valid session—for example, from prior access or a stolen session token—the victim changing their password does not terminate that…
Błąd w porównywaniu ClientGUID w kernelu Linux umożliwia fałszywe traktowanie różnych wartości jako równych.
Atak XXE w IBM Business Automation Manager umożliwia zdalne ujawnienie danych.
Błąd w filtrze safe wprowadza możliwość ataków SQL/LDAP przez niewłaściwe rozszerzenie zmiennych.
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the…
Luka w Oracle Advanced Outbound Telephony pozwala na nieautoryzowany dostęp do danych.
Luka w Oracle In-Memory Cost Management pozwala na nieautoryzowany dostęp do krytycznych danych.
Luka w Oracle WebCenter Sites pozwala nieautoryzowanym atakującym na dostęp do krytycznych danych.
Wstrzyknięcie poleceń w IBM AIX i PowerVM VIOS umożliwia zdalne wykonanie kodu.
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the…
Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Workbench.…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Wykorzystanie podatności w Langchain-Chatchat umożliwia atakującemu zapis plików w dowolnych lokalizacjach. | Wykorzystanie podatności w Langchain-Chatchat umożliwia atakującemu zapis plików w dowolnych lokalizacjach. |
W tym tygodniu | 9,1 | 0,42 % | ||
| The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input… | The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue… |
W tym tygodniu | 9,1 | 0,42 % | ||
| A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated… | A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters. |
Obserwuj | 8,8 | 1,91 % | ||
| Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Identity Manager… |
W tym tygodniu | 9,1 | 0,41 % | ||
| Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Identity Manager… |
W tym tygodniu | 9,1 | 0,41 % | ||
| Docat is a tool for hosting versioned static documentation. | Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overwrite sensitive configuration files or place… |
W tym tygodniu | 9,1 | 0,41 % | ||
| Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated… | Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can… |
W tym tygodniu | 9,1 | 0,41 % | ||
| Ucieczka z piaskownicy w komponencie XPConnect umożliwia zdalne wykonanie kodu. | Ucieczka z piaskownicy w komponencie XPConnect umożliwia zdalne wykonanie kodu. |
W tym tygodniu | 9,1 | 0,41 % | ||
| Błąd w NewKeyring() pozwala na użycie kluczy bez potwierdzenia, co narusza bezpieczeństwo. | Błąd w NewKeyring() pozwala na użycie kluczy bez potwierdzenia, co narusza bezpieczeństwo. |
W tym tygodniu | 9,1 | 0,41 % | ||
| WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and… | WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or… |
W tym tygodniu | 9,1 | 0,41 % | ||
| Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored… | Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the… |
W tym tygodniu | 9,1 | 0,41 % | ||
| Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote,… |
W tym tygodniu | 9,1 | 0,41 % | ||
| Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle… |
W tym tygodniu | 9,1 | 0,41 % | ||
| Nieograniczony upload niebezpiecznych plików w Contentstudio umożliwia wgranie powłoki sieciowej. | Nieograniczony upload niebezpiecznych plików w Contentstudio umożliwia wgranie powłoki sieciowej. |
W tym tygodniu | 9,1 | 0,41 % | ||
| Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. | Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an attacker already possesses a valid session—for example, from prior access or a stolen session token—the victim changing their password does not terminate that… |
W tym tygodniu | 9,1 | 0,41 % | ||
| Błąd w porównywaniu ClientGUID w kernelu Linux umożliwia fałszywe traktowanie różnych wartości jako równych. | Błąd w porównywaniu ClientGUID w kernelu Linux umożliwia fałszywe traktowanie różnych wartości jako równych. |
W tym tygodniu | 9,1 | 0,41 % | ||
| Atak XXE w IBM Business Automation Manager umożliwia zdalne ujawnienie danych. | Atak XXE w IBM Business Automation Manager umożliwia zdalne ujawnienie danych. |
W tym tygodniu | 9,1 | 0,41 % | ||
| Błąd w filtrze safe wprowadza możliwość ataków SQL/LDAP przez niewłaściwe rozszerzenie zmiennych. | Błąd w filtrze safe wprowadza możliwość ataków SQL/LDAP przez niewłaściwe rozszerzenie zmiennych. |
W tym tygodniu | 9,1 | 0,41 % | ||
| OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. | OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the… |
W tym tygodniu | 9,1 | 0,4 % | ||
| Luka w Oracle Advanced Outbound Telephony pozwala na nieautoryzowany dostęp do danych. | Luka w Oracle Advanced Outbound Telephony pozwala na nieautoryzowany dostęp do danych. |
W tym tygodniu | 9,1 | 0,4 % | ||
| Luka w Oracle In-Memory Cost Management pozwala na nieautoryzowany dostęp do krytycznych danych. | Luka w Oracle In-Memory Cost Management pozwala na nieautoryzowany dostęp do krytycznych danych. |
W tym tygodniu | 9,1 | 0,4 % | ||
| Luka w Oracle WebCenter Sites pozwala nieautoryzowanym atakującym na dostęp do krytycznych danych. | Luka w Oracle WebCenter Sites pozwala nieautoryzowanym atakującym na dostęp do krytycznych danych. |
W tym tygodniu | 9,1 | 0,4 % | ||
| Wstrzyknięcie poleceń w IBM AIX i PowerVM VIOS umożliwia zdalne wykonanie kodu. | Wstrzyknięcie poleceń w IBM AIX i PowerVM VIOS umożliwia zdalne wykonanie kodu. |
Obserwuj | 8,8 | 1,9 % | ||
| vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack… | vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the… |
W tym tygodniu | 9,1 | 0,4 % | ||
| Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI). | Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Workbench.… |
W tym tygodniu | 9,1 | 0,4 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.