Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
This
vulnerability exists in the Radius
Xenia M2M Platform due to insufficient validation of user supplied input in
the password recovery functionality in the web management interface. An
unauthenticated remote attacker could exploit this vulnerability by supplying
crafted SQL query through input…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load child_process and run…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files.
This issue affects Elementor Pro: from n/a through 4.2.1.
Opis źródłowy NVD · ENCVSS 9,0 · EPSS 1,99 % · rekomendacja wg zapisanej polityki
Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions contain a path traversal vulnerability because user input is not properly sanitized.
This could allow a remote attacker to access arbitrary files on the device.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki
SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the id_video parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki
The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki
BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki
This
vulnerability exists in the Radius
Xenia M2M Platform due to insufficient validation of user supplied input in
the password recovery functionality in the web management interface. An
unauthenticated remote attacker could exploit this vulnerability by supplying
crafted SQL query through input…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load child_process and run…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files.
This issue affects Elementor Pro: from n/a through 4.2.1.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,0 · EPSS 1,99 % · rekomendacja wg zapisanej polityki
Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions contain a path traversal vulnerability because user input is not properly sanitized.
This could allow a remote attacker to access arbitrary files on the device.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki
SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the id_video parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki
The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki
BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,48 % · rekomendacja wg zapisanej polityki