KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.
Luka w Langflow umożliwia przejęcie konta i zdalne wykonanie kodu.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via…
Wykonanie kodu zdalnego w Embedthis GoAhead umożliwia wykorzystanie niezaufanych parametrów HTTP.
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.
Przechodzenie do katalogów w UnRAR umożliwia zapis plików podczas rozpakowywania.
A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability…
Wykonanie poleceń na hoście w LiteLLM umożliwia zdalne uruchamianie komend przez użytkowników.
W TeamCity umożliwiono atak typu path traversal, co pozwala na ograniczone działania administracyjne.
Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode"…
Podatność w Windows Search umożliwia zdalne wykonanie kodu.
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.
The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in…
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access…
.NET Framework Information Disclosure Vulnerability
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially…
An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
Wstrzyknięcie poleceń w GoAnywhere MFT umożliwia zdalne wykonanie kodu przed uwierzytelnieniem.
Błąd typu confusion w Artifex Ghostscript umożliwia zdalne wykonanie kodu przez bypass -dSAFER.
Wykorzystanie po zwolnieniu pamięci w Internet Explorerze umożliwia zdalne wykonanie kodu.
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.
Luka w integracji ConnectWise ManagedITSync umożliwia zdalne wykonanie poleceń bez uwierzytelnienia.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host… | SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine. |
Pilne działanie | 7,5 | 99,61 % | ||
| This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. | This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions. |
Pilne działanie | 9,8 | 88,1 % | ||
| Luka w Langflow umożliwia przejęcie konta i zdalne wykonanie kodu. | Luka w Langflow umożliwia przejęcie konta i zdalne wykonanie kodu. |
Pilne działanie | 8,8 | 92,81 % | ||
| Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via… |
Pilne działanie | 7,5 | 99,27 % | ||
| Wykonanie kodu zdalnego w Embedthis GoAhead umożliwia wykorzystanie niezaufanych parametrów HTTP. | Wykonanie kodu zdalnego w Embedthis GoAhead umożliwia wykorzystanie niezaufanych parametrów HTTP. |
Pilne działanie | 8,1 | 96,26 % | ||
| Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited… | Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025. |
Pilne działanie | 9,8 | 87,76 % | ||
| Przechodzenie do katalogów w UnRAR umożliwia zapis plików podczas rozpakowywania. | Przechodzenie do katalogów w UnRAR umożliwia zapis plików podczas rozpakowywania. |
Pilne działanie | 7,5 | 99,23 % | ||
| A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting… | A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability… |
Pilne działanie | 9,8 | 87,69 % | ||
| Wykonanie poleceń na hoście w LiteLLM umożliwia zdalne uruchamianie komend przez użytkowników. | Wykonanie poleceń na hoście w LiteLLM umożliwia zdalne uruchamianie komend przez użytkowników. |
Pilne działanie | 8,8 | 92,57 % | ||
| W TeamCity umożliwiono atak typu path traversal, co pozwala na ograniczone działania administracyjne. | W TeamCity umożliwiono atak typu path traversal, co pozwala na ograniczone działania administracyjne. |
Pilne działanie | 7,3 | 99,99 % | ||
| Grafana is an open source data visualization platform. | Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode"… |
Pilne działanie | 7,3 | 99,93 % | ||
| Podatność w Windows Search umożliwia zdalne wykonanie kodu. | Podatność w Windows Search umożliwia zdalne wykonanie kodu. |
Pilne działanie | 7,5 | 98,93 % | ||
| vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_pane… | vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. |
Pilne działanie | 9,8 | 87,37 % | ||
| The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers… | The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in… |
Pilne działanie | 9,8 | 87,33 % | ||
| A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an… | A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user. |
Pilne działanie | 9,8 | 87,26 % | ||
| Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access… |
Pilne działanie | 7,8 | 97,23 % | ||
| .NET Framework Information Disclosure Vulnerability | .NET Framework Information Disclosure Vulnerability |
Pilne działanie | 7,5 | 98,62 % | ||
| Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. | Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially… |
Pilne działanie | 7,5 | 98,57 % | ||
| An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as… | An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. |
Pilne działanie | 7,5 | 98,55 % | ||
| There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted… | There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed. |
Pilne działanie | 7,5 | 98,51 % | ||
| Wstrzyknięcie poleceń w GoAnywhere MFT umożliwia zdalne wykonanie kodu przed uwierzytelnieniem. | Wstrzyknięcie poleceń w GoAnywhere MFT umożliwia zdalne wykonanie kodu przed uwierzytelnieniem. |
Pilne działanie | 7,2 | 100 % | ||
| Błąd typu confusion w Artifex Ghostscript umożliwia zdalne wykonanie kodu przez bypass -dSAFER. | Błąd typu confusion w Artifex Ghostscript umożliwia zdalne wykonanie kodu przez bypass -dSAFER. |
Pilne działanie | 7,8 | 96,97 % | ||
| Wykorzystanie po zwolnieniu pamięci w Internet Explorerze umożliwia zdalne wykonanie kodu. | Wykorzystanie po zwolnieniu pamięci w Internet Explorerze umożliwia zdalne wykonanie kodu. |
Pilne działanie | 8,8 | 91,94 % | ||
| octobercms in a CMS platform based on the Laravel PHP Framework. | octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5. |
Pilne działanie | 9,1 | 90,42 % | ||
| Luka w integracji ConnectWise ManagedITSync umożliwia zdalne wykonanie poleceń bez uwierzytelnienia. | Luka w integracji ConnectWise ManagedITSync umożliwia zdalne wykonanie poleceń bez uwierzytelnienia. |
Pilne działanie | 9,8 | 86,82 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.