KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated…
The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.
A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. This issue requires IKE to be enabled with an RSA-signature IKE policy to be…
Błąd autoryzacji w ColdFusion umożliwia eskalację uprawnień i nieautoryzowany dostęp.
The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application interprets the entered string of characters as a Java expression, allowing an unauthenticated attacer to perform arbitrary code…
Improper Authentication vulnerability in GE Vernova Smallworld on Windows, Linux allows Authentication Abuse.This issue affects Smallworld: 5.3.3 and prior versions for Linux, and 5.3.4. and prior versions for Windows.
Wstrzyknięcie SQL w Storage Concentrator umożliwia zdalne wydobycie wrażliwych danych.
Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or…
Wstrzyknięcie poleceń w Apache CloudStack umożliwia zdalne wykonanie kodu jako root.
DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, as well as overwrite existing files in that directory. An…
Brak autoryzacji w Google Cloud Application Integration umożliwia dostęp do wrażliwych danych.
Brak weryfikacji adresu e-mail w Rocket.Chat umożliwia przejęcie konta.
Błąd w openssl_encrypt umożliwia obejście uwierzytelnienia i ataki bit-flipping.
Brak uwierzytelnienia w usłudze zarządzania zdalnego SenseLive X3050 umożliwia nieautoryzowane operacje na firmware.
P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the…
x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated…
Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who…
An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component
Luka w Capgo umożliwia przejęcie konta przez atakującego z dostępem admina.
Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.
Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.
Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.
Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions.
Unauthenticated SQL Injection in Boost <= 2.0.4 versions.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute… | OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua. |
W tym tygodniu | 8,8 | 2,91 % | ||
| The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response,… | The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated… |
W tym tygodniu | 9,3 | 0,41 % | ||
| The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic… | The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise. |
W tym tygodniu | 9,3 | 0,41 % | ||
| A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated… | A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. This issue requires IKE to be enabled with an RSA-signature IKE policy to be… |
W tym tygodniu | 9,3 | 0,41 % | ||
| Błąd autoryzacji w ColdFusion umożliwia eskalację uprawnień i nieautoryzowany dostęp. | Błąd autoryzacji w ColdFusion umożliwia eskalację uprawnień i nieautoryzowany dostęp. |
W tym tygodniu | 9,3 | 0,41 % | ||
| The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. | The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application interprets the entered string of characters as a Java expression, allowing an unauthenticated attacer to perform arbitrary code… |
W tym tygodniu | 9,3 | 0,41 % | ||
| Improper Authentication vulnerability in GE Vernova Smallworld on Windows, Linux allows Authentication Abuse.This issue affects… | Improper Authentication vulnerability in GE Vernova Smallworld on Windows, Linux allows Authentication Abuse.This issue affects Smallworld: 5.3.3 and prior versions for Linux, and 5.3.4. and prior versions for Windows. |
W tym tygodniu | 9,3 | 0,41 % | ||
| Wstrzyknięcie SQL w Storage Concentrator umożliwia zdalne wydobycie wrażliwych danych. | Wstrzyknięcie SQL w Storage Concentrator umożliwia zdalne wydobycie wrażliwych danych. |
W tym tygodniu | 9,3 | 0,41 % | ||
| Metabase is an open source business intelligence and analytics platform. | Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or… |
W tym tygodniu | 9,3 | 0,41 % | ||
| Wstrzyknięcie poleceń w Apache CloudStack umożliwia zdalne wykonanie kodu jako root. | Wstrzyknięcie poleceń w Apache CloudStack umożliwia zdalne wykonanie kodu jako root. |
Obserwuj | 8,8 | 2,91 % | ||
| DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload… | DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, as well as overwrite existing files in that directory. An… |
W tym tygodniu | 9,3 | 0,41 % | ||
| Brak autoryzacji w Google Cloud Application Integration umożliwia dostęp do wrażliwych danych. | Brak autoryzacji w Google Cloud Application Integration umożliwia dostęp do wrażliwych danych. |
W tym tygodniu | 9,3 | 0,41 % | ||
| Brak weryfikacji adresu e-mail w Rocket.Chat umożliwia przejęcie konta. | Brak weryfikacji adresu e-mail w Rocket.Chat umożliwia przejęcie konta. |
W tym tygodniu | 9,3 | 0,41 % | ||
| Błąd w openssl_encrypt umożliwia obejście uwierzytelnienia i ataki bit-flipping. | Błąd w openssl_encrypt umożliwia obejście uwierzytelnienia i ataki bit-flipping. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Brak uwierzytelnienia w usłudze zarządzania zdalnego SenseLive X3050 umożliwia nieautoryzowane operacje na firmware. | Brak uwierzytelnienia w usłudze zarządzania zdalnego SenseLive X3050 umożliwia nieautoryzowane operacje na firmware. |
W tym tygodniu | 9,3 | 0,4 % | ||
| P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request… | P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the… |
W tym tygodniu | 9,3 | 0,4 % | ||
| x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. | x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated… |
W tym tygodniu | 9,3 | 0,4 % | ||
| Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic… | Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who… |
W tym tygodniu | 9,3 | 0,4 % | ||
| An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component | An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component |
W tym tygodniu | 9,3 | 0,4 % | ||
| Luka w Capgo umożliwia przejęcie konta przez atakującego z dostępem admina. | Luka w Capgo umożliwia przejęcie konta przez atakującego z dostępem admina. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions. | Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Unauthenticated SQL Injection in Epayco <= 8.4.6 versions. | Unauthenticated SQL Injection in Epayco <= 8.4.6 versions. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions. | Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions. | Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions. |
W tym tygodniu | 9,3 | 0,4 % | ||
| Unauthenticated SQL Injection in Boost <= 2.0.4 versions. | Unauthenticated SQL Injection in Boost <= 2.0.4 versions. |
W tym tygodniu | 9,3 | 0,4 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.