Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests.
This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application.
This…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Gin-vue-admin is a backstage management system based on vue and gin. In 2.8.6 and earlier, attackers can delete any file on the server at will, causing damage or unavailability of server resources. Attackers can control the 'FileMd5' parameter to delete any file and folder.
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations.
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as root. The impact is lower in Windows deployments.
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-S1930 S1930SWITCH_3.0(1)B11P230 allowing attackers to execute arbitrary commands via a crafted POST request to the module_update in file /usr/local/lua/dev_config/ace_sw.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 2,07 % · rekomendacja wg zapisanej polityki
Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests.
This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,59 % · rekomendacja wg zapisanej polityki
A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application.
This…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Gin-vue-admin is a backstage management system based on vue and gin. In 2.8.6 and earlier, attackers can delete any file on the server at will, causing damage or unavailability of server resources. Attackers can control the 'FileMd5' parameter to delete any file and folder.
Opis źródłowy NVD · EN
Pilne działanie
CVSS 9,1 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as root. The impact is lower in Windows deployments.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,58 % · rekomendacja wg zapisanej polityki
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,57 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-S1930 S1930SWITCH_3.0(1)B11P230 allowing attackers to execute arbitrary commands via a crafted POST request to the module_update in file /usr/local/lua/dev_config/ace_sw.lua.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 2,07 % · rekomendacja wg zapisanej polityki