Podatności

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original…

CVSS 9,4 · EPSS 0,19 % · rekomendacja wg zapisanej polityki

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.

CVSS 9,3 · EPSS 0,64 % · rekomendacja wg zapisanej polityki

A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated…

CVSS 9,3 · EPSS 0,63 % · rekomendacja wg zapisanej polityki

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit:…

CVSS 9,3 · EPSS 0,62 % · rekomendacja wg zapisanej polityki

lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.

CVSS 9,3 · EPSS 0,6 % · rekomendacja wg zapisanej polityki

A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly execute arbitrary code by sending a Bolt RESET message with an attacker-chosen chunk size to the Bolt…

CVSS 9,3 · EPSS 0,6 % · rekomendacja wg zapisanej polityki

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an…

CVSS 9,3 · EPSS 0,57 % · rekomendacja wg zapisanej polityki

A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no…

CVSS 9,3 · EPSS 0,55 % · rekomendacja wg zapisanej polityki

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application…

CVSS 9,3 · EPSS 0,52 % · rekomendacja wg zapisanej polityki

dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load child_process and run…

CVSS 9,3 · EPSS 0,5 % · rekomendacja wg zapisanej polityki

The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl based deployments, HTTP request headers may be mapped to corresponding HTTP_* environment…

CVSS 9,4 · rekomendacja wg zapisanej polityki

Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and…

CVSS 9,4 · rekomendacja wg zapisanej polityki

This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system.…

CVSS 9,3 · EPSS 0,42 % · rekomendacja wg zapisanej polityki

x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated…

CVSS 9,3 · EPSS 0,4 % · rekomendacja wg zapisanej polityki

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or…

CVSS 9,3 · EPSS 0,39 % · rekomendacja wg zapisanej polityki

Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.

CVSS 9,3 · EPSS 0,38 % · rekomendacja wg zapisanej polityki

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, and…

CVSS 9,3 · EPSS 0,38 % · rekomendacja wg zapisanej polityki

Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.

CVSS 9,3 · EPSS 0,38 % · rekomendacja wg zapisanej polityki

Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions.

CVSS 9,3 · EPSS 0,38 % · rekomendacja wg zapisanej polityki

A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials.

CVSS 9,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki

This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and extracting the embedded credentials and…

CVSS 9,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki

An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services.

CVSS 9,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset_key…

CVSS 9,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints. Attackers can send…

CVSS 9,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.

CVSS 9,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki