KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent BGP peer to cause a denial of service when labeled-unicast aggregate-label is configured.
A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated IS-IS peer to cause a denial of service.
An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a malformed PIM Hello message received on an IPv6-enabled PIM interface.
A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured.
An Allocation of Resources Without Limits or Throttling vulnerability in rpd, the routing protocol daemon, of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service and heap memory corruption via OSPFv3 messages on an…
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP global-load-balancing and more than 128 ecmp next-hops allows an attacker to cause an rpd crash.
A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic.
LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, email…
MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only…
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf(). An authenticated user who can upload a small PDF with an oversized…
An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a denial of service and l2cpd restart via FNP-enabled Layer 2 interfaces. The issue is triggered when the FNP feature is…
An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast…
An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon and disclose limited process memory via a specific CFM Message sent to a configured interface.
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits.
Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial…
Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data…
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their assigned role permits.
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits.
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned…
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation information beyond what…
Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role permits.
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond their permitted role.
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role…
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their assigned role permits.
Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a… | A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent BGP peer to cause a denial of service when labeled-unicast aggregate-label is configured. |
Obserwuj | 7,1 | 0,27 % | ||
| A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS… | A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated IS-IS peer to cause a denial of service. |
Obserwuj | 7,1 | 0,27 % | ||
| An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated… | An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a malformed PIM Hello message received on an IPv6-enabled PIM interface. |
Obserwuj | 7,1 | 0,27 % | ||
| A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an… | A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured. |
Obserwuj | 7,1 | 0,27 % | ||
| An Allocation of Resources Without Limits or Throttling vulnerability in rpd, the routing protocol daemon, of Juniper Networks Junos OS… | An Allocation of Resources Without Limits or Throttling vulnerability in rpd, the routing protocol daemon, of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service and heap memory corruption via OSPFv3 messages on an… |
Obserwuj | 7,1 | 0,27 % | ||
| An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and… | An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241 and QFX5250 configured for BGP global-load-balancing and more than 128 ecmp next-hops allows an attacker to cause an rpd crash. |
Obserwuj | 7,1 | 0,27 % | ||
| A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent… | A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on the SRX Series allows an adjacent attacker to cause a denial of service of the data plane via chassis-cluster fabric traffic. |
Obserwuj | 7,1 | 0,27 % | ||
| LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via… | LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, email… |
Obserwuj | 7,1 | 0,27 % | ||
| MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify… | MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only… |
Obserwuj | 7,1 | 0,27 % | ||
| Lychee is a free, open-source photo-management tool. | Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf(). An authenticated user who can upload a small PDF with an oversized… |
Obserwuj | 7,1 | 0,27 % | ||
| An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent… | An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a denial of service and l2cpd restart via FNP-enabled Layer 2 interfaces. The issue is triggered when the FNP feature is… |
Obserwuj | 7,1 | 0,27 % | ||
| An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS… | An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast… |
Obserwuj | 7,1 | 0,27 % | ||
| An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated… | An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent-network attacker to crash the daemon and disclose limited process memory via a specific CFM Message sent to a configured interface. |
Obserwuj | 7,1 | 0,27 % | ||
| Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to… | Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits. |
Obserwuj | 7,1 | 0,26 % | ||
| Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to… | Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial… |
Obserwuj | 7,1 | 0,26 % | ||
| Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to… | Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data… |
Obserwuj | 7,1 | 0,26 % | ||
| Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to… | Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their assigned role permits. |
Obserwuj | 7,1 | 0,26 % | ||
| Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to… | Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits. |
Obserwuj | 7,1 | 0,26 % | ||
| Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints… | Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned… |
Obserwuj | 7,1 | 0,26 % | ||
| Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to… | Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation information beyond what… |
Obserwuj | 7,1 | 0,26 % | ||
| Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to… | Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role permits. |
Obserwuj | 7,1 | 0,26 % | ||
| Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to… | Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond their permitted role. |
Obserwuj | 7,1 | 0,26 % | ||
| Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to… | Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role… |
Obserwuj | 7,1 | 0,26 % | ||
| Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to… | Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their assigned role permits. |
Obserwuj | 7,1 | 0,26 % | ||
| Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond… | Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view. |
Obserwuj | 7,1 | 0,26 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.