Podatności

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without…

CVSS 7,1 · EPSS 0,36 % · rekomendacja wg zapisanej polityki

Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to execute code over an adjacent network.

CVSS 7,1 · EPSS 0,36 % · rekomendacja wg zapisanej polityki

NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictions on the /nornicdb/search and /nornicdb/similar endpoints. Viewer-role users allowlisted for a database but denied read can submit search queries or node IDs…

CVSS 7,1 · EPSS 0,35 % · rekomendacja wg zapisanej polityki

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied…

CVSS 7,1 · EPSS 0,35 % · rekomendacja wg zapisanej polityki

Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.

CVSS 7,1 · EPSS 0,35 % · rekomendacja wg zapisanej polityki

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain…

CVSS 7,1 · EPSS 0,35 % · rekomendacja wg zapisanej polityki

A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration…

CVSS 7,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to…

CVSS 7,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a…

CVSS 7,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct net_eth_vlan_hdr…

CVSS 7,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive…

CVSS 7,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive…

CVSS 7,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset…

CVSS 7,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown. The cooldown (cooldown config, HEX_COOLDOWN) withholds versions younger than the configured…

CVSS 7,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki

Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting…

CVSS 7,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request.

CVSS 7,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.

CVSS 7,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users() and user() return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt…

CVSS 7,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces.

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit large memory allocations. Attackers can send a seven-byte DATA_FIRST message on an opened DVC declaring a large 32-bit length,…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

A Missing Release of Memory after Effective Lifetime vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via crafted packets when the static MAC-IP feature is in use.

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses,…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki