KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Niezamierzona podatność pośrednika w Nuvation Energy MSC umożliwia naruszenie granic sieci.
Błąd uwierzytelniania w Gmission Web Fax umożliwia eskalację uprawnień.
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. Users with the "Manage roles and permissions" privilege can promote themselves or other DOC users to the Supervisor role through an API call. This privilege is included by default in the…
Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any attacker to access the Setting Center. This means that this is effectively backdoor for all devices utilizing a Growatt…
The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and to extracting secrets or domains from within the device
ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the server. This may allow an attacker to replace legitimate files being deployed to devices with their own malicious versions, since the firmware…
Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impersonated simply by knowing their 'numerical ID', meaning that an attacker could compromise another user's account, thereby affecting the confidentiality, integrity, and…
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection.
Obejście ochrony hasłem w DVP-12SE11T umożliwia nieautoryzowany dostęp.
A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. This affects the function check/uncheck/delete of the file application/Comment/Controller/CommentadminController.class.php of the component CommentadminController. The manipulation of the argument…
Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and…
A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .
Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Niezamierzona podatność pośrednika w Nuvation Energy MSC umożliwia naruszenie granic sieci. | Niezamierzona podatność pośrednika w Nuvation Energy MSC umożliwia naruszenie granic sieci. |
W tym tygodniu | 9,8 | 0,32 % | ||
| Błąd uwierzytelniania w Gmission Web Fax umożliwia eskalację uprawnień. | Błąd uwierzytelniania w Gmission Web Fax umożliwia eskalację uprawnień. |
W tym tygodniu | 9,8 | 0,32 % | ||
| An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. | An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. Users with the "Manage roles and permissions" privilege can promote themselves or other DOC users to the Supervisor role through an API call. This privilege is included by default in the… |
W tym tygodniu | 9,8 | 0,32 % | ||
| Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level… | Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any attacker to access the Setting Center. This means that this is effectively backdoor for all devices utilizing a Growatt… |
W tym tygodniu | 9,8 | 0,32 % | ||
| The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug… | The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and to extracting secrets or domains from within the device |
W tym tygodniu | 9,8 | 0,32 % | ||
| ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP… | ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the server. This may allow an attacker to replace legitimate files being deployed to devices with their own malicious versions, since the firmware… |
W tym tygodniu | 9,8 | 0,32 % | ||
| Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impersonated simply by… | Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impersonated simply by knowing their 'numerical ID', meaning that an attacker could compromise another user's account, thereby affecting the confidentiality, integrity, and… |
W tym tygodniu | 9,8 | 0,32 % | ||
| IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection. | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection. |
W tym tygodniu | 9,8 | 0,32 % | ||
| Obejście ochrony hasłem w DVP-12SE11T umożliwia nieautoryzowany dostęp. | Obejście ochrony hasłem w DVP-12SE11T umożliwia nieautoryzowany dostęp. |
W tym tygodniu | 9,8 | 0,32 % | ||
| A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. | A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. This affects the function check/uncheck/delete of the file application/Comment/Controller/CommentadminController.class.php of the component CommentadminController. The manipulation of the argument… |
W tym tygodniu | 9,8 | 0,32 % | ||
| Memory safety bugs present in Thunderbird ESR 140.12. | Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and… |
W tym tygodniu | 9,8 | 0,32 % | ||
| A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . | A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . |
W tym tygodniu | 9,8 | 0,31 % | ||
| Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object… | Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue… | Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. | Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. | Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. | Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. | Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions. | Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions. | Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in Windsor <= 2.10 versions. | Unauthenticated PHP Object Injection in Windsor <= 2.10 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. | Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions. | Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in Law Office <= 3.20 versions. | Unauthenticated PHP Object Injection in Law Office <= 3.20 versions. |
W tym tygodniu | 9,8 | 0,31 % | ||
| Unauthenticated PHP Object Injection in Invetex <= 2.18 versions. | Unauthenticated PHP Object Injection in Invetex <= 2.18 versions. |
W tym tygodniu | 9,8 | 0,31 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.