Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `POST /api/data/add_podcast` in `rust-api/src/handlers/podcasts.rs`. `get_podcast_values` and `add_episodes` in…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `openssl_pkcs7_verify(...,…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.
A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope.
What DESTROY does depends on…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.The function `grayscale_convert` is called…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's `boring-tls` integration silently disables TLS hostname verification for callers using the default (strict) configuration. An on-path attacker presenting any…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
CVSS
9,1
EPSS
0,32 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `POST /api/data/add_podcast` in `rust-api/src/handlers/podcasts.rs`. `get_podcast_values` and `add_episodes` in…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `openssl_pkcs7_verify(...,…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.
A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope.
What DESTROY does depends on…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.The function `grayscale_convert` is called…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's `boring-tls` integration silently disables TLS hostname verification for callers using the default (strict) configuration. An on-path attacker presenting any…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
9,1
0,32 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.