Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setVpnAccountCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument User leads to os command injection. The attack can be executed remotely.…
Opis źródłowy NVD · ENCVSS 8,9 · EPSS 2,43 % · rekomendacja wg zapisanej polityki
This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system.…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 2,92 % · rekomendacja wg zapisanej polityki
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey,…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge results in os command injection. It is possible to launch the…
Opis źródłowy NVD · ENCVSS 8,9 · EPSS 2,42 % · rekomendacja wg zapisanej polityki
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,92 % · rekomendacja wg zapisanej polityki
openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowing…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.
When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 2,91 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 2,91 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 2,91 % · rekomendacja wg zapisanej polityki
CVSS
8,8
EPSS
2,91 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setVpnAccountCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument User leads to os command injection. The attack can be executed remotely.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,9 · EPSS 2,43 % · rekomendacja wg zapisanej polityki
This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system.…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 2,92 % · rekomendacja wg zapisanej polityki
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey,…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge results in os command injection. It is possible to launch the…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,9 · EPSS 2,42 % · rekomendacja wg zapisanej polityki
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery(). An unauthenticated attacker can supply arbitrary SQL…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,92 % · rekomendacja wg zapisanej polityki
openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki
Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowing…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.
When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 2,91 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 2,91 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 2,91 % · rekomendacja wg zapisanej polityki
8,8
2,91 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.