KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to…
Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS…
Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions.
Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete…
Wstrzyknięcie SQL w katalogu produktów eCommerce umożliwia nieautoryzowany dostęp do danych.
Wstrzyknięcie SQL w Advanced 301 i 302 Redirect umożliwia nieautoryzowany dostęp do danych.
Wstrzyknięcie SQL w SpeakOut! Email Petitions umożliwia nieautoryzowany dostęp do danych.
Podatność XSS w Adobe Connect umożliwia wykonanie złośliwego kodu JavaScript w przeglądarce ofiary.
Odbicie XSS w Adobe Connect pozwala na wykonanie złośliwego kodu w przeglądarce ofiary.
Odbicie XSS w Adobe Connect pozwala na wykonanie złośliwego kodu w przeglądarce ofiary.
Nieautoryzowany dostęp do punktu końcowego w HAPI FHIR pozwala na kradzież tokenów uwierzytelniających.
Wstrzyknięcie złośliwego kodu w ChatterMate umożliwia kradzież danych klienta.
An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this…
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
Brak autoryzacji w wtyczce Grav API pozwala na nieautoryzowane zapisywanie plików w innych kontach.
Podatność CSRF w Halo CMS umożliwia zdalnemu atakującemu wykonanie dowolnego kodu.
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execute a Command Injection on the host device.
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device.
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects Mang Board WP: from n/a through 2.4.4.
Unauthenticated SQL Injection in uListing <= 2.2.0 versions.
Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP…
SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. | IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. |
W tym tygodniu | 9,3 | 0,31 % | ||
| NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/*… | NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to… |
W tym tygodniu | 9,2 | 0,81 % | ||
| Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials… | Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS… |
W tym tygodniu | 9,3 | 0,31 % | ||
| Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions. | Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions. |
W tym tygodniu | 9,3 | 0,3 % | ||
| Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other… | Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete… |
W tym tygodniu | 9,3 | 0,3 % | ||
| Wstrzyknięcie SQL w katalogu produktów eCommerce umożliwia nieautoryzowany dostęp do danych. | Wstrzyknięcie SQL w katalogu produktów eCommerce umożliwia nieautoryzowany dostęp do danych. |
W tym tygodniu | 9,3 | 0,3 % | ||
| Wstrzyknięcie SQL w Advanced 301 i 302 Redirect umożliwia nieautoryzowany dostęp do danych. | Wstrzyknięcie SQL w Advanced 301 i 302 Redirect umożliwia nieautoryzowany dostęp do danych. |
W tym tygodniu | 9,3 | 0,3 % | ||
| Wstrzyknięcie SQL w SpeakOut! | Wstrzyknięcie SQL w SpeakOut! Email Petitions umożliwia nieautoryzowany dostęp do danych. |
W tym tygodniu | 9,3 | 0,3 % | ||
| Podatność XSS w Adobe Connect umożliwia wykonanie złośliwego kodu JavaScript w przeglądarce ofiary. | Podatność XSS w Adobe Connect umożliwia wykonanie złośliwego kodu JavaScript w przeglądarce ofiary. |
W tym tygodniu | 9,3 | 0,3 % | ||
| Odbicie XSS w Adobe Connect pozwala na wykonanie złośliwego kodu w przeglądarce ofiary. | Odbicie XSS w Adobe Connect pozwala na wykonanie złośliwego kodu w przeglądarce ofiary. |
W tym tygodniu | 9,3 | 0,3 % | ||
| Odbicie XSS w Adobe Connect pozwala na wykonanie złośliwego kodu w przeglądarce ofiary. | Odbicie XSS w Adobe Connect pozwala na wykonanie złośliwego kodu w przeglądarce ofiary. |
W tym tygodniu | 9,3 | 0,3 % | ||
| Nieautoryzowany dostęp do punktu końcowego w HAPI FHIR pozwala na kradzież tokenów uwierzytelniających. | Nieautoryzowany dostęp do punktu końcowego w HAPI FHIR pozwala na kradzież tokenów uwierzytelniających. |
Pilne działanie | 9,3 | 0,3 % | ||
| Wstrzyknięcie złośliwego kodu w ChatterMate umożliwia kradzież danych klienta. | Wstrzyknięcie złośliwego kodu w ChatterMate umożliwia kradzież danych klienta. |
Pilne działanie | 9,3 | 0,3 % | ||
| An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s):… | An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this… |
W tym tygodniu | 9,1 | 1,3 % | ||
| A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. | A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system. |
W tym tygodniu | 9,3 | 0,3 % | ||
| Brak autoryzacji w wtyczce Grav API pozwala na nieautoryzowane zapisywanie plików w innych kontach. | Brak autoryzacji w wtyczce Grav API pozwala na nieautoryzowane zapisywanie plików w innych kontach. |
W tym tygodniu | 9,3 | 0,3 % | ||
| Podatność CSRF w Halo CMS umożliwia zdalnemu atakującemu wykonanie dowolnego kodu. | Podatność CSRF w Halo CMS umożliwia zdalnemu atakującemu wykonanie dowolnego kodu. |
W tym tygodniu | 9,3 | 0,3 % | ||
| A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID… | A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execute a Command Injection on the host device. |
W tym tygodniu | 9,1 | 1,29 % | ||
| A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi… | A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device. |
W tym tygodniu | 9,1 | 1,29 % | ||
| A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi… | A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device. |
W tym tygodniu | 9,1 | 1,29 % | ||
| A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi… | A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device. |
W tym tygodniu | 9,1 | 1,29 % | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kitae Park Mang Board WP mangboard… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects Mang Board WP: from n/a through 2.4.4. |
W tym tygodniu | 9,3 | 0,29 % | ||
| Unauthenticated SQL Injection in uListing <= 2.2.0 versions. | Unauthenticated SQL Injection in uListing <= 2.2.0 versions. |
W tym tygodniu | 9,3 | 0,29 % | ||
| Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. | Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP… |
W tym tygodniu | 9,3 | 0,29 % | ||
| SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and… | SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication. |
W tym tygodniu | 9,3 | 0,29 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.