Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Stack-based buffer overflow and missing
authorization vulnerability in Thales Sentinel Keys Server on Windows allows
Overflow Buffers. Sentinel Keys Server does not check the length of the first
field in the HTTP request. An attacker may craft an HTTP request and send it to
Sentinel Keys Server.…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the network to intercept and potentially manipulate communication requests between the inverter and its cloud endpoint.
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,07 % · rekomendacja wg zapisanej polityki
The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
Bypass vulnerability in the authentication method in the GTT Tax Information System application, related to the Active Directory (LDAP) login method.
Authentication is performed through a local WebSocket, but the web application does not properly validate the authenticity or origin of the data…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,56 % · rekomendacja wg zapisanej polityki
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,56 % · rekomendacja wg zapisanej polityki
Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Stack-based buffer overflow and missing
authorization vulnerability in Thales Sentinel Keys Server on Windows allows
Overflow Buffers. Sentinel Keys Server does not check the length of the first
field in the HTTP request. An attacker may craft an HTTP request and send it to
Sentinel Keys Server.…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the network to intercept and potentially manipulate communication requests between the inverter and its cloud endpoint.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,07 % · rekomendacja wg zapisanej polityki
The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
Bypass vulnerability in the authentication method in the GTT Tax Information System application, related to the Active Directory (LDAP) login method.
Authentication is performed through a local WebSocket, but the web application does not properly validate the authenticity or origin of the data…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,56 % · rekomendacja wg zapisanej polityki
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,56 % · rekomendacja wg zapisanej polityki