KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Wstrzyknięcie poleceń w Apache CloudStack umożliwia zdalne wykonanie kodu jako root.
DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, as well as overwrite existing files in that directory. An…
Brak autoryzacji w Google Cloud Application Integration umożliwia dostęp do wrażliwych danych.
Błąd w openssl_encrypt umożliwia obejście uwierzytelnienia i ataki bit-flipping.
Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery (SSRF) vulnerability in the xmlrpc.sock handler. The product accepts specially crafted XML-RPC requests that can be used to instruct the server to connect to internal unix…
x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated…
Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who…
An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component
Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.
Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.
Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.
Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions.
Unauthenticated SQL Injection in Boost <= 2.0.4 versions.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DiviNext Woo Essential allows SQL Injection. This issue affects Woo Essential: from n/a through 4.3.0.
Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.
Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.
Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.
Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions.
Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions.
Wstrzyknięcie SQL w Capella umożliwia nieautoryzowany dostęp do danych.
Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions.
Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.
Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.
Wstrzyknięcie SQL w NGG Smart Image Search umożliwia nieautoryzowany dostęp do danych.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Wstrzyknięcie poleceń w Apache CloudStack umożliwia zdalne wykonanie kodu jako root. | Wstrzyknięcie poleceń w Apache CloudStack umożliwia zdalne wykonanie kodu jako root. |
Obserwuj | 8,8 | 2,91 % | ||
| DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload… | DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, as well as overwrite existing files in that directory. An… |
W tym tygodniu | 9,3 | 0,41 % | ||
| Brak autoryzacji w Google Cloud Application Integration umożliwia dostęp do wrażliwych danych. | Brak autoryzacji w Google Cloud Application Integration umożliwia dostęp do wrażliwych danych. |
W tym tygodniu | 9,3 | 0,41 % | ||
| Błąd w openssl_encrypt umożliwia obejście uwierzytelnienia i ataki bit-flipping. | Błąd w openssl_encrypt umożliwia obejście uwierzytelnienia i ataki bit-flipping. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery (SSRF)… | Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery (SSRF) vulnerability in the xmlrpc.sock handler. The product accepts specially crafted XML-RPC requests that can be used to instruct the server to connect to internal unix… |
W tym tygodniu | 9,3 | 0,4 % | ||
| x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. | x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated… |
W tym tygodniu | 9,3 | 0,4 % | ||
| Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic… | Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who… |
W tym tygodniu | 9,3 | 0,4 % | ||
| An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component | An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component |
W tym tygodniu | 9,3 | 0,4 % | ||
| Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions. | Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Unauthenticated SQL Injection in Epayco <= 8.4.6 versions. | Unauthenticated SQL Injection in Epayco <= 8.4.6 versions. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions. | Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions. | Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Unauthenticated SQL Injection in Boost <= 2.0.4 versions. | Unauthenticated SQL Injection in Boost <= 2.0.4 versions. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DiviNext Woo Essential allows SQL… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DiviNext Woo Essential allows SQL Injection. This issue affects Woo Essential: from n/a through 4.3.0. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions. | Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions. | Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions. | Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions. | Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions. | Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions. | Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Wstrzyknięcie SQL w Capella umożliwia nieautoryzowany dostęp do danych. | Wstrzyknięcie SQL w Capella umożliwia nieautoryzowany dostęp do danych. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions. | Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions. | Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions. | Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Wstrzyknięcie SQL w NGG Smart Image Search umożliwia nieautoryzowany dostęp do danych. | Wstrzyknięcie SQL w NGG Smart Image Search umożliwia nieautoryzowany dostęp do danych. |
W tym tygodniu | 9,3 | 0,4 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.