Podatności

MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications…

CVSS 6,9 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+ DWG file with a large 'schdat'…

CVSS 6,9 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseNewHmp() that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing…

CVSS 6,9 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed RTF properties. Attackers can deliver a crafted winmail.dat whose decompressed RTF lacks a NUL terminator, causing printf to over-read,…

CVSS 6,9 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedb_record_get_multi_value() that allows attackers to read past buffers via unbounded multi-value offset tables. Attackers can supply a crafted ESE/EDB database processed by esedbexport to crash the…

CVSS 6,9 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST…

CVSS 6,9 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not divisible by three or two in a…

CVSS 6,9 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the…

CVSS 6,9 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.

CVSS 6,9 · EPSS 0,12 % · rekomendacja wg zapisanej polityki

On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it.

CVSS 6,9 · EPSS 0,11 % · rekomendacja wg zapisanej polityki

Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive.

CVSS 6,9 · EPSS 0,11 % · rekomendacja wg zapisanej polityki

Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.

CVSS 6,9 · EPSS 0,11 % · rekomendacja wg zapisanej polityki

Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications.

CVSS 6,9 · EPSS 0,1 % · rekomendacja wg zapisanej polityki

Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization…

CVSS 6,8 · EPSS 0,56 % · rekomendacja wg zapisanej polityki

Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.

CVSS 6,8 · EPSS 0,53 % · rekomendacja wg zapisanej polityki

Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke…

CVSS 6,9 · rekomendacja wg zapisanej polityki

99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values…

CVSS 6,9 · rekomendacja wg zapisanej polityki

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail,…

CVSS 6,9 · rekomendacja wg zapisanej polityki

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService,…

CVSS 6,9 · rekomendacja wg zapisanej polityki

Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/* paths for .jpg, .png, .bmp, or .mp4 files, which are…

CVSS 6,9 · rekomendacja wg zapisanej polityki

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve…

CVSS 6,9 · rekomendacja wg zapisanej polityki

Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to…

CVSS 6,9 · rekomendacja wg zapisanej polityki

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id…

CVSS 6,9 · rekomendacja wg zapisanej polityki

An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.

CVSS 6,9 · rekomendacja wg zapisanej polityki

The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without further authentication…

CVSS 6,9 · rekomendacja wg zapisanej polityki