KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when processing certain inputs.
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.
Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.
Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.
Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions.
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user…
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user…
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user…
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server, which could result in unauthorized access.
Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5.
Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled load_ini_buffer utility and strip_ini_cache()
Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network.
undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the…
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid…
Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16.8.1.
Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2.
A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.
A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption
FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes…
The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In deployments that use SAML authentication, an unauthenticated remote attacker could cause the affected server to accept an assertion that…
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an… | IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when processing certain inputs. |
Obserwuj | 7,5 | 0,31 % | ||
| IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation. | IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation. |
Obserwuj | 7,5 | 0,31 % | ||
| Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. | Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. |
Obserwuj | 7,5 | 0,31 % | ||
| A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of… | A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service. |
Obserwuj | 7,5 | 0,31 % | ||
| Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions. | Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions. |
Obserwuj | 7,5 | 0,3 % | ||
| Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions. | Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions. |
Obserwuj | 7,5 | 0,3 % | ||
| CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user… |
Obserwuj | 7,5 | 0,3 % | ||
| CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user… |
Obserwuj | 7,5 | 0,3 % | ||
| CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user… |
Obserwuj | 7,5 | 0,3 % | ||
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that… | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server, which could result in unauthorized access. |
Obserwuj | 7,5 | 0,29 % | ||
| Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from… | Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5. |
Obserwuj | 7,5 | 0,29 % | ||
| Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally. | Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally. |
Obserwuj | 7,5 | 0,29 % | ||
| Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an… | Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled load_ini_buffer utility and strip_ini_cache() |
Obserwuj | 7,5 | 0,29 % | ||
| Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network. | Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network. |
Obserwuj | 7,5 | 0,28 % | ||
| undici is an HTTP client library for Node.js. | undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the… |
Obserwuj | 7,5 | 0,28 % | ||
| GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by… | GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid… |
Obserwuj | 7,5 | 0,28 % | ||
| Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP:… | Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16.8.1. |
Obserwuj | 7,5 | 0,27 % | ||
| Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator:… | Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2. |
Obserwuj | 7,5 | 0,27 % | ||
| A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS. | A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS. |
Obserwuj | 7,5 | 0,27 % | ||
| A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption | A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption |
Obserwuj | 7,5 | 0,26 % | ||
| FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing… | FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes… |
Obserwuj | 7,5 | 0,26 % | ||
| The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages… | The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide. |
Obserwuj | 7,5 | 0,25 % | ||
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in… | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In deployments that use SAML authentication, an unauthenticated remote attacker could cause the affected server to accept an assertion that… |
Obserwuj | 7,5 | 0,25 % | ||
| Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce… | Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3. |
Obserwuj | 7,5 | 0,25 % | ||
| Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions… | Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled. |
Obserwuj | 7,5 | 0,25 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.