Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system.…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 2,92 % · rekomendacja wg zapisanej polityki
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey,…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowing…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.
When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 2,91 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 2,91 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 2,91 % · rekomendacja wg zapisanej polityki
The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
The firmware update process for the basemodule of the charging controller only validates the
CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.
This issue requires IKE to be enabled with an RSA-signature IKE policy to be…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system.…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 2,92 % · rekomendacja wg zapisanej polityki
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey,…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowing…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.
When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 2,91 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 2,91 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 2,91 % · rekomendacja wg zapisanej polityki
The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
The firmware update process for the basemodule of the charging controller only validates the
CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.
This issue requires IKE to be enabled with an RSA-signature IKE policy to be…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki