KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the…
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring.
EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the 'forgot password' link, thereby successfully resetting any user's password.
Obejście uwierzytelnienia w Tycon Systems TPDIN-Monitor-WEB2 umożliwia zdalny dostęp do urządzenia.
A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no…
Wykorzystanie podatności w Intrado 911 EGW pozwala na odczytanie dowolnych plików.
The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). This allows either a full system compromise from local or remote (if the daemon is running as root) or a full account takeover (if the daemon is running in user…
Brak uwierzytelnienia w ColdFusion umożliwia zdalne wykonanie kodu w kontekście bieżącego użytkownika.
Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal…
Nieprawidłowy proces klonowania bazy danych w Plesk pozwala na wykonanie dowolnego kodu przez użytkownika.
Wstrzyknięcie SQL w TBEA TLogger umożliwia zdalne odczytywanie i modyfikowanie danych.
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_wireless in file /usr/lib/lua/luci/control/admin/wireless.lua.
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_deal_update in file /usr/lib/lua/luci/controller/api/rcmsAPI.lua.
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the network_set_wan_conf in file /usr/lib/lua/luci/controller/admin/netport.lua.
New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website.
Wstrzyknięcie poleceń w module sieciowym Honeywell umożliwia zdalne wykonanie kodu.
Wstrzyknięcie argumentów w Salesforce Marketing Cloud Engagement umożliwia manipulację protokołem usług webowych.
A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected…
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any…
FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-controlled fromPath and toPath body fields with the trusted…
Podatność w Eclipse Equinox OSGi umożliwia zdalne wykonanie kodu przez nieautoryzowanych atakujących.
Obejście uwierzytelnienia w Coverity Connect umożliwia przejęcie uprawnień użytkownika.
Wstrzyknięcie poleceń w SonicWall NSM umożliwia zdalne wykonanie kodu przez SuperAdmina.
An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where… | Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the… |
W tym tygodniu | 9,3 | 0,56 % | ||
| A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows… | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring. |
W tym tygodniu | 9,3 | 0,56 % | ||
| EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to… | EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the 'forgot password' link, thereby successfully resetting any user's password. |
W tym tygodniu | 9,3 | 0,56 % | ||
| Obejście uwierzytelnienia w Tycon Systems TPDIN-Monitor-WEB2 umożliwia zdalny dostęp do urządzenia. | Obejście uwierzytelnienia w Tycon Systems TPDIN-Monitor-WEB2 umożliwia zdalny dostęp do urządzenia. |
W tym tygodniu | 9,3 | 0,56 % | ||
| A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders… | A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no… |
W tym tygodniu | 9,3 | 0,55 % | ||
| Wykorzystanie podatności w Intrado 911 EGW pozwala na odczytanie dowolnych plików. | Wykorzystanie podatności w Intrado 911 EGW pozwala na odczytanie dowolnych plików. |
W tym tygodniu | 9,3 | 0,55 % | ||
| The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). | The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). This allows either a full system compromise from local or remote (if the daemon is running as root) or a full account takeover (if the daemon is running in user… |
W tym tygodniu | 9,3 | 0,55 % | ||
| Brak uwierzytelnienia w ColdFusion umożliwia zdalne wykonanie kodu w kontekście bieżącego użytkownika. | Brak uwierzytelnienia w ColdFusion umożliwia zdalne wykonanie kodu w kontekście bieżącego użytkownika. |
W tym tygodniu | 9,3 | 0,55 % | ||
| Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to… | Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal… |
W tym tygodniu | 9,3 | 0,55 % | ||
| Nieprawidłowy proces klonowania bazy danych w Plesk pozwala na wykonanie dowolnego kodu przez użytkownika. | Nieprawidłowy proces klonowania bazy danych w Plesk pozwala na wykonanie dowolnego kodu przez użytkownika. |
W tym tygodniu | 9,3 | 0,55 % | ||
| Wstrzyknięcie SQL w TBEA TLogger umożliwia zdalne odczytywanie i modyfikowanie danych. | Wstrzyknięcie SQL w TBEA TLogger umożliwia zdalne odczytywanie i modyfikowanie danych. |
W tym tygodniu | 9,3 | 0,55 % | ||
| OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted… | OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua. |
W tym tygodniu | 8,8 | 3,05 % | ||
| OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request… | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_wireless in file /usr/lib/lua/luci/control/admin/wireless.lua. |
W tym tygodniu | 8,8 | 3,05 % | ||
| OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request… | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_deal_update in file /usr/lib/lua/luci/controller/api/rcmsAPI.lua. |
W tym tygodniu | 8,8 | 3,05 % | ||
| OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request… | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the network_set_wan_conf in file /usr/lib/lua/luci/controller/admin/netport.lua. |
W tym tygodniu | 8,8 | 3,05 % | ||
| New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers… | New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website. |
W tym tygodniu | 9,3 | 0,55 % | ||
| Wstrzyknięcie poleceń w module sieciowym Honeywell umożliwia zdalne wykonanie kodu. | Wstrzyknięcie poleceń w module sieciowym Honeywell umożliwia zdalne wykonanie kodu. |
W tym tygodniu | 9,1 | 1,55 % | ||
| Wstrzyknięcie argumentów w Salesforce Marketing Cloud Engagement umożliwia manipulację protokołem usług webowych. | Wstrzyknięcie argumentów w Salesforce Marketing Cloud Engagement umożliwia manipulację protokołem usług webowych. |
W tym tygodniu | 9,4 | 0,05 % | ||
| A security vulnerability has been identified in the WolfProt interface implementation. | A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected… |
W tym tygodniu | 9,3 | 0,55 % | ||
| IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable… | IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any… |
W tym tygodniu | 9,3 | 0,55 % | ||
| FileBrowser Quantum is a free, self-hosted, web-based file manager. | FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-controlled fromPath and toPath body fields with the trusted… |
W tym tygodniu | 9,3 | 0,55 % | ||
| Podatność w Eclipse Equinox OSGi umożliwia zdalne wykonanie kodu przez nieautoryzowanych atakujących. | Podatność w Eclipse Equinox OSGi umożliwia zdalne wykonanie kodu przez nieautoryzowanych atakujących. |
W tym tygodniu | 9,3 | 0,55 % | ||
| Obejście uwierzytelnienia w Coverity Connect umożliwia przejęcie uprawnień użytkownika. | Obejście uwierzytelnienia w Coverity Connect umożliwia przejęcie uprawnień użytkownika. |
W tym tygodniu | 9,3 | 0,55 % | ||
| Wstrzyknięcie poleceń w SonicWall NSM umożliwia zdalne wykonanie kodu przez SuperAdmina. | Wstrzyknięcie poleceń w SonicWall NSM umożliwia zdalne wykonanie kodu przez SuperAdmina. |
W tym tygodniu | 9,1 | 1,55 % | ||
| An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network… | An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request. |
W tym tygodniu | 9,3 | 0,55 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.