Podatności

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to…

CVSS 7,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a…

CVSS 7,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct net_eth_vlan_hdr…

CVSS 7,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive…

CVSS 7,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive…

CVSS 7,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset…

CVSS 7,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown. The cooldown (cooldown config, HEX_COOLDOWN) withholds versions younger than the configured…

CVSS 7,1 · EPSS 0,33 % · rekomendacja wg zapisanej polityki

Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting…

CVSS 7,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request.

CVSS 7,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.

CVSS 7,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users() and user() return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt…

CVSS 7,1 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces.

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit large memory allocations. Attackers can send a seven-byte DATA_FIRST message on an opened DVC declaring a large 32-bit length,…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

A Missing Release of Memory after Effective Lifetime vulnerability in the l2ald process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via crafted packets when the static MAC-IP feature is in use.

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses,…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grep_knowledge_files or grep_chat_files with a catastrophically backtracking…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,…

CVSS 7,1 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate sequential refundId values to obtain…

CVSS 7,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire sys_log table,…

CVSS 7,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update route with a target identifier to…

CVSS 7,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN…

CVSS 7,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki