Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 1 % · rekomendacja wg zapisanej polityki
An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version:
QuMagie 2.9.2…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
A parameter taken from the request body is inserted into
a T-SQL statement without parameterization or escaping, allowing
a remote attacker to execute arbitrary SQL statements in the context of the
application's database account.
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,47 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
riscv: lib: Fix ZBB strnlen reading past count boundary
The ZBB-optimized strnlen loop loads one word ahead before checking the
aligned boundary:
REG_L t1, SZREG(t0) // load next word
addi t0, t0, SZREG…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_service in file /usr/lib/lua/luci/controller/admin/service.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 3,46 % · rekomendacja wg zapisanej polityki
Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the Legacy Remoting Service that is enabled by default. The service registers a TCP remoting channel…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,96 % · rekomendacja wg zapisanej polityki
COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack array by sending a crafted UDP datagram containing more than 15 ACF-CAN messages. The avtp_to_can() function increments its write…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 3,95 % · rekomendacja wg zapisanej polityki
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 1 % · rekomendacja wg zapisanej polityki
An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version:
QuMagie 2.9.2…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
A parameter taken from the request body is inserted into
a T-SQL statement without parameterization or escaping, allowing
a remote attacker to execute arbitrary SQL statements in the context of the
application's database account.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,47 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
riscv: lib: Fix ZBB strnlen reading past count boundary
The ZBB-optimized strnlen loop loads one word ahead before checking the
aligned boundary:
REG_L t1, SZREG(t0) // load next word
addi t0, t0, SZREG…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_service in file /usr/lib/lua/luci/controller/admin/service.lua.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 3,46 % · rekomendacja wg zapisanej polityki
Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the Legacy Remoting Service that is enabled by default. The service registers a TCP remoting channel…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,96 % · rekomendacja wg zapisanej polityki
COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack array by sending a crafted UDP datagram containing more than 15 ACF-CAN messages. The avtp_to_can() function increments its write…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 3,95 % · rekomendacja wg zapisanej polityki
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,45 % · rekomendacja wg zapisanej polityki
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,45 % · rekomendacja wg zapisanej polityki