Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no check on whether the sender was a trusted proxy, falling back to the client-supplied Host header.…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.The function `null_convert` is called based…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information.
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
TOTOLINK A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6448_B20240521 and V9.3.5u.6437_B20230519 are vulnerable to Incorrect Access Control. Attackers can send payloads to the interface without logging in (remote).
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates.
The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available.
An attacker…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpcon_check_session_url of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed…
Opis źródłowy NVD · ENCVSS 8,9 · EPSS 1,33 % · rekomendacja wg zapisanej polityki
Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no check on whether the sender was a trusted proxy, falling back to the client-supplied Host header.…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.The function `null_convert` is called based…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
TOTOLINK A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6448_B20240521 and V9.3.5u.6437_B20230519 are vulnerable to Incorrect Access Control. Attackers can send payloads to the interface without logging in (remote).
Opis źródłowy NVD · EN
Pilne działanie
CVSS 9,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates.
The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available.
An attacker…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpcon_check_session_url of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,9 · EPSS 1,33 % · rekomendacja wg zapisanej polityki
Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki