KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network.
A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUERY to cause a denial of service and possibly disclose or corrupt memory. The function accepts a --bolt argument from any…
A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, and…
AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model…
Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with a bare >& redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo…
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this information, which could result in unauthorized…
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID…
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column…
IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper memory allocation during key derivation.
CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's…
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration,…
A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading…
The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref:…
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy.
Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network.
Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network.
Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.
Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.
Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network.
Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.
Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network. | Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network. |
Obserwuj | 7,7 | 0,37 % | ||
| A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote… | A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUERY to cause a denial of service and possibly disclose or corrupt memory. The function accepts a --bolt argument from any… |
Obserwuj | 7,7 | 0,35 % | ||
| A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to… | A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, and… |
Obserwuj | 7,7 | 0,34 % | ||
| AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote… | AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model… |
Obserwuj | 7,7 | 0,33 % | ||
| Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve… | Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with a bare >& redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo… |
Obserwuj | 7,7 | 0,32 % | ||
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain… | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this information, which could result in unauthorized… |
Obserwuj | 7,7 | 0,3 % | ||
| OpenRemote is an open-source internet-of-things platform. | OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID… |
Obserwuj | 7,7 | 0,29 % | ||
| Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and… | Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column… |
Obserwuj | 7,7 | 0,29 % | ||
| IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper… | IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper memory allocation during key derivation. |
Obserwuj | 7,7 | 0,28 % | ||
| CVFS contained a missing authentication condition affecting command execution. | CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS. |
Obserwuj | 7,7 | 0,23 % | ||
| GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2… | GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's… |
Obserwuj | 7,7 | 0,23 % | ||
| FrankenPHP is a modern application server for PHP. | FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration,… |
Obserwuj | 7,7 | 0,23 % | ||
| A flaw was found in the OpenShift console. | A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading… |
Obserwuj | 7,7 | 0,21 % | ||
| The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no… | The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref:… |
Obserwuj | 7,7 | 0,21 % | ||
| IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for… | IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy. |
Obserwuj | 7,7 | 0,2 % | ||
| Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network. | Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 1,2 % | ||
| Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 1,2 % | ||
| Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network. | Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 1,2 % | ||
| Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network. | Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 1,2 % | ||
| Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a… | Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 1,2 % | ||
| Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network. | Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 1,2 % | ||
| Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network. | Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 1,2 % | ||
| Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
Obserwuj | 7,5 | 1,2 % | ||
| Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network. | Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 1,15 % | ||
| Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network. | Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 1,15 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.