Podatności

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to…

CVSS 7,7 · rekomendacja wg zapisanej polityki

Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links,…

CVSS 7,7 · rekomendacja wg zapisanej polityki

Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.

CVSS 7,5 · EPSS 0,97 % · rekomendacja wg zapisanej polityki

Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.

CVSS 7,5 · EPSS 0,97 % · rekomendacja wg zapisanej polityki

Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthorized attacker to disclose information over a network.

CVSS 7,5 · EPSS 0,96 % · rekomendacja wg zapisanej polityki

Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network.

CVSS 7,5 · EPSS 0,92 % · rekomendacja wg zapisanej polityki

Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 0,89 % · rekomendacja wg zapisanej polityki

Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 0,88 % · rekomendacja wg zapisanej polityki

Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.

CVSS 7,5 · EPSS 0,88 % · rekomendacja wg zapisanej polityki

Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 0,87 % · rekomendacja wg zapisanej polityki

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit…

CVSS 7,6 · EPSS 0,37 % · rekomendacja wg zapisanej polityki

ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not…

CVSS 7,5 · EPSS 0,86 % · rekomendacja wg zapisanej polityki

Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 0,85 % · rekomendacja wg zapisanej polityki

Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 0,83 % · rekomendacja wg zapisanej polityki

Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 0,83 % · rekomendacja wg zapisanej polityki

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

CVSS 7,6 · EPSS 0,33 % · rekomendacja wg zapisanej polityki

Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal…

CVSS 7,6 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Subscriber Settings Change in uListing <= 2.2.0 versions.

CVSS 7,6 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

Subscriber Settings Change in Pubjet | پاب‌جت <= 5.4.8 versions.

CVSS 7,6 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.

CVSS 7,6 · EPSS 0,28 % · rekomendacja wg zapisanej polityki

Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.

CVSS 7,6 · EPSS 0,28 % · rekomendacja wg zapisanej polityki

Administrator SQL Injection in Leyka <= 3.32.3 versions.

CVSS 7,6 · EPSS 0,28 % · rekomendacja wg zapisanej polityki

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 0,77 % · rekomendacja wg zapisanej polityki

Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 0,77 % · rekomendacja wg zapisanej polityki

Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

CVSS 7,5 · EPSS 0,77 % · rekomendacja wg zapisanej polityki