Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. An…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (component: Helpdesk/Training). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Self Service.…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, EXPRESSCLUSTER X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 allows an attacker sends…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics.…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset_key…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. An…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (component: Helpdesk/Training). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Self Service.…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, EXPRESSCLUSTER X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 allows an attacker sends…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics.…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset_key…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki