KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker to deny service over a network.
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal…
Subscriber Settings Change in uListing <= 2.2.0 versions.
Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions.
Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.
Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.
Administrator SQL Injection in Leyka <= 3.32.3 versions.
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0, generated applications can persist attacker-controlled Blob data and companion ContentType values, return…
Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change…
IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges.
No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and…
OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field
Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable…
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP…
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker to deny service over a network. | Missing reference to active allocated resource in Windows SMB Server allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 0,83 % | ||
| IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an… | IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw. |
Obserwuj | 7,6 | 0,33 % | ||
| Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user… | Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal… |
Obserwuj | 7,6 | 0,32 % | ||
| Subscriber Settings Change in uListing <= 2.2.0 versions. | Subscriber Settings Change in uListing <= 2.2.0 versions. |
Obserwuj | 7,6 | 0,3 % | ||
| Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions. | Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions. |
Obserwuj | 7,6 | 0,29 % | ||
| Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions. | Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions. |
Obserwuj | 7,6 | 0,28 % | ||
| Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions. | Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions. |
Obserwuj | 7,6 | 0,28 % | ||
| Administrator SQL Injection in Leyka <= 3.32.3 versions. | Administrator SQL Injection in Leyka <= 3.32.3 versions. |
Obserwuj | 7,6 | 0,28 % | ||
| Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 0,77 % | ||
| Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network. | Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 0,77 % | ||
| Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny… | Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 0,77 % | ||
| Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. | Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. |
Obserwuj | 7,5 | 0,77 % | ||
| JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. | JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0, generated applications can persist attacker-controlled Blob data and companion ContentType values, return… |
Obserwuj | 7,6 | 0,26 % | ||
| Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session… | Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change… |
Obserwuj | 7,6 | 0,25 % | ||
| IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. | IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges. |
Obserwuj | 7,2 | 2,25 % | ||
| No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. |
Obserwuj | 7,5 | 0,74 % | ||
| MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to… | MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or… |
Obserwuj | 7,6 | 0,24 % | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1. |
Obserwuj | 7,6 | 0,24 % | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free… | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7. |
Obserwuj | 7,6 | 0,23 % | ||
| OpenRemote is an open-source internet-of-things platform. | OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and… |
Obserwuj | 7,6 | 0,22 % | ||
| OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field | OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field |
Obserwuj | 7,6 | 0,22 % | ||
| Tina is a headless content management system. | Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable… |
Obserwuj | 7,6 | 0,21 % | ||
| The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. | The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP… |
Obserwuj | 7,5 | 0,7 % | ||
| Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a… | Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network. |
Obserwuj | 7,5 | 0,69 % | ||
| Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network. | Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network. |
Obserwuj | 7,5 | 0,69 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.