Podatności

A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization…

CVSS 7,1 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.

CVSS 7,1 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBT_TILE_FIRST then WBT_TILE_UPGRADE sequence to paint heap bytes onscreen or…

CVSS 7,1 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO…

CVSS 7,1 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by supplying an arbitrary bizId to the listFileByBizId endpoint. Attackers can retrieve file names, storage paths, MD5 hashes and…

CVSS 7,1 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). Attackers can craft a .gitmodules submodule name containing…

CVSS 7,1 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/send. Unauthenticated attackers reaching port 18790, which binds all interfaces by default, can inject blind prompts into…

CVSS 7,1 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to…

CVSS 7,1 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale

CVSS 7,1 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients…

CVSS 7,1 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.

CVSS 7,1 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can send requests to these endpoints to create documents against…

CVSS 7,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via…

CVSS 7,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond what their…

CVSS 7,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records.

CVSS 7,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted…

CVSS 7,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permits.

CVSS 7,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is…

CVSS 7,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control.

CVSS 7,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(nbr->idx) without first checking whether the neighbor cache entry actually had a linked link-layer address. An unresolved neighbor carries idx == NET_NBR_LLADDR_UNKNOWN (0xff),…

CVSS 7,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

SQL injection in the bulk license plate search of the Flock Night Shift hosted service allowed an authenticated user to read other customer organizations' data, including license plate recognition records, via a crafted license plate value. Data could not be modified. Flock identified the issue…

CVSS 7,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to their own workflow with an HTTP node,…

CVSS 7,1 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify third-party application configurations. Low-privileged attackers can replace client id, client secret, agent id and corp id of DingTalk, WeCom or…

CVSS 7,1 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST /sys/tenant/changeOwenUserTenant. Low-privileged attackers can supply userId and tenantId parameters to reassign any tenant's owner to a member, including…

CVSS 7,1 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could allow an attacker to have read access the Tuleap database.

CVSS 7,1 · EPSS 0,21 % · rekomendacja wg zapisanej polityki