Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf.Api.Token) via an Authorization header (Token/Bearer) or a ?token= query parameter, and neither path is…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,78 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/host_access_delay.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 3,27 % · rekomendacja wg zapisanej polityki
A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,77 % · rekomendacja wg zapisanej polityki
LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded __import__,…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,77 % · rekomendacja wg zapisanej polityki
Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf.Api.Token) via an Authorization header (Token/Bearer) or a ?token= query parameter, and neither path is…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,78 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/host_access_delay.lua.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 3,27 % · rekomendacja wg zapisanej polityki
A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,77 % · rekomendacja wg zapisanej polityki
LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded __import__,…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,77 % · rekomendacja wg zapisanej polityki
Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,25 % · rekomendacja wg zapisanej polityki