Podatności

Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.

CVSS 7,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.

CVSS 7,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql…

CVSS 7,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound…

CVSS 7,2 · EPSS 0,75 % · rekomendacja wg zapisanej polityki

Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2.

CVSS 7,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for…

CVSS 7,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can modify inference_information.json can point it at a…

CVSS 7,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

CVSS 7,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes…

CVSS 7,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() in mt.c passed the constructed command…

CVSS 7,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could…

CVSS 7,2 · EPSS 0,71 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the…

CVSS 7,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the…

CVSS 7,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVSS 7,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that…

CVSS 7,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object.…

CVSS 7,2 · EPSS 0,64 % · rekomendacja wg zapisanej polityki

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash…

CVSS 7,3 · EPSS 0,14 % · rekomendacja wg zapisanej polityki

NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.

CVSS 7,3 · EPSS 0,14 % · rekomendacja wg zapisanej polityki

ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with…

CVSS 7,3 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, information disclosure, and data tampering.

CVSS 7,3 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability mighty lead to information disclosure, data tampering, and denial of service.

CVSS 7,3 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device.

CVSS 7,3 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability might lead to information disclosure and denial of service.

CVSS 7,3 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer…

CVSS 7,3 · EPSS 0,08 % · rekomendacja wg zapisanej polityki

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central…

CVSS 7,2 · EPSS 0,54 % · rekomendacja wg zapisanej polityki