KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
W podatności w OpenCart umożliwia przejęcie sesji użytkownika przez manipulację ciasteczkiem OCSESSID.
OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey,…
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL…
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An…
Luka w Mira Android APK umożliwia zdalny dostęp do profili zdrowia reprodukcyjnego.
Wstrzyknięcie poleceń w Microsoft Copilot umożliwia nieautoryzowanym atakującym manipulację w sieci.
Przepełnienie bufora w kliencie MQTT Contiki-NG umożliwia zdalne wykonanie kodu.
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain…
openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter…
Cross-site scripting w Cal.com umożliwia atakującemu wstrzyknięcie złośliwego kodu.
W Cal.com występuje podatność na XSS, umożliwiająca atakującemu wstrzyknięcie kodu JavaScript.
A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.
Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowing…
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this…
Brak uwierzytelnienia w dodatku Portal Generator do Priority ERP umożliwia nieautoryzowany dostęp.
OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated…
The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.
A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. This issue requires IKE to be enabled with an RSA-signature IKE policy to be…
Błąd autoryzacji w ColdFusion umożliwia eskalację uprawnień i nieautoryzowany dostęp.
The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application interprets the entered string of characters as a Java expression, allowing an unauthenticated attacer to perform arbitrary code…
Improper Authentication vulnerability in GE Vernova Smallworld on Windows, Linux allows Authentication Abuse.This issue affects Smallworld: 5.3.3 and prior versions for Linux, and 5.3.4. and prior versions for Windows.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| W podatności w OpenCart umożliwia przejęcie sesji użytkownika przez manipulację ciasteczkiem OCSESSID. | W podatności w OpenCart umożliwia przejęcie sesji użytkownika przez manipulację ciasteczkiem OCSESSID. |
W tym tygodniu | 9,3 | 0,42 % | ||
| OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute… | OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua. |
W tym tygodniu | 8,8 | 2,92 % | ||
| phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to… | phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey,… |
W tym tygodniu | 9,3 | 0,42 % | ||
| Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition… | Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL… |
W tym tygodniu | 9,3 | 0,42 % | ||
| Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[]… | Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An… |
W tym tygodniu | 9,3 | 0,42 % | ||
| Luka w Mira Android APK umożliwia zdalny dostęp do profili zdrowia reprodukcyjnego. | Luka w Mira Android APK umożliwia zdalny dostęp do profili zdrowia reprodukcyjnego. |
W tym tygodniu | 9,3 | 0,42 % | ||
| Wstrzyknięcie poleceń w Microsoft Copilot umożliwia nieautoryzowanym atakującym manipulację w sieci. | Wstrzyknięcie poleceń w Microsoft Copilot umożliwia nieautoryzowanym atakującym manipulację w sieci. |
W tym tygodniu | 9,3 | 0,42 % | ||
| Przepełnienie bufora w kliencie MQTT Contiki-NG umożliwia zdalne wykonanie kodu. | Przepełnienie bufora w kliencie MQTT Contiki-NG umożliwia zdalne wykonanie kodu. |
W tym tygodniu | 9,2 | 0,92 % | ||
| FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super… | FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain… |
W tym tygodniu | 9,3 | 0,42 % | ||
| openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to… | openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter… |
W tym tygodniu | 9,3 | 0,42 % | ||
| Cross-site scripting w Cal.com umożliwia atakującemu wstrzyknięcie złośliwego kodu. | Cross-site scripting w Cal.com umożliwia atakującemu wstrzyknięcie złośliwego kodu. |
W tym tygodniu | 9,3 | 0,42 % | ||
| W Cal.com występuje podatność na XSS, umożliwiająca atakującemu wstrzyknięcie kodu JavaScript. | W Cal.com występuje podatność na XSS, umożliwiająca atakującemu wstrzyknięcie kodu JavaScript. |
W tym tygodniu | 9,3 | 0,42 % | ||
| A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism. | A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism. |
W tym tygodniu | 9,3 | 0,41 % | ||
| Activepieces is an open source AI workflow automation platform. | Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowing… |
W tym tygodniu | 9,3 | 0,41 % | ||
| Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. | Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this… |
W tym tygodniu | 9,3 | 0,41 % | ||
| Brak uwierzytelnienia w dodatku Portal Generator do Priority ERP umożliwia nieautoryzowany dostęp. | Brak uwierzytelnienia w dodatku Portal Generator do Priority ERP umożliwia nieautoryzowany dostęp. |
W tym tygodniu | 9,3 | 0,41 % | ||
| OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary… | OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua. |
W tym tygodniu | 8,8 | 2,91 % | ||
| OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a… | OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua. |
W tym tygodniu | 8,8 | 2,91 % | ||
| OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute… | OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua. |
W tym tygodniu | 8,8 | 2,91 % | ||
| The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response,… | The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated… |
W tym tygodniu | 9,3 | 0,41 % | ||
| The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic… | The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise. |
W tym tygodniu | 9,3 | 0,41 % | ||
| A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated… | A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. This issue requires IKE to be enabled with an RSA-signature IKE policy to be… |
W tym tygodniu | 9,3 | 0,41 % | ||
| Błąd autoryzacji w ColdFusion umożliwia eskalację uprawnień i nieautoryzowany dostęp. | Błąd autoryzacji w ColdFusion umożliwia eskalację uprawnień i nieautoryzowany dostęp. |
W tym tygodniu | 9,3 | 0,41 % | ||
| The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. | The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application interprets the entered string of characters as a Java expression, allowing an unauthenticated attacer to perform arbitrary code… |
W tym tygodniu | 9,3 | 0,41 % | ||
| Improper Authentication vulnerability in GE Vernova Smallworld on Windows, Linux allows Authentication Abuse.This issue affects… | Improper Authentication vulnerability in GE Vernova Smallworld on Windows, Linux allows Authentication Abuse.This issue affects Smallworld: 5.3.3 and prior versions for Linux, and 5.3.4. and prior versions for Windows. |
W tym tygodniu | 9,3 | 0,41 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.