Podatności

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this information, which could result in unauthorized…

CVSS 7,7 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID…

CVSS 7,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column…

CVSS 7,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper memory allocation during key derivation.

CVSS 7,7 · EPSS 0,28 % · rekomendacja wg zapisanej polityki

CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.

CVSS 7,7 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's…

CVSS 7,7 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration,…

CVSS 7,7 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading…

CVSS 7,7 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref:…

CVSS 7,7 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy.

CVSS 7,7 · EPSS 0,2 % · rekomendacja wg zapisanej polityki

Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 1,2 % · rekomendacja wg zapisanej polityki

Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 1,2 % · rekomendacja wg zapisanej polityki

Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 1,2 % · rekomendacja wg zapisanej polityki

Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 1,2 % · rekomendacja wg zapisanej polityki

Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 1,2 % · rekomendacja wg zapisanej polityki

Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 1,2 % · rekomendacja wg zapisanej polityki

Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 1,2 % · rekomendacja wg zapisanej polityki

Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

CVSS 7,5 · EPSS 1,2 % · rekomendacja wg zapisanej polityki

Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 1,15 % · rekomendacja wg zapisanej polityki

Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 1,15 % · rekomendacja wg zapisanej polityki

Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 1,15 % · rekomendacja wg zapisanej polityki

Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 1,15 % · rekomendacja wg zapisanej polityki

Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 1,15 % · rekomendacja wg zapisanej polityki

Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 1,15 % · rekomendacja wg zapisanej polityki

Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 1,15 % · rekomendacja wg zapisanej polityki