Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
Opis źródłowy NVD · ENCVSS 6,6 · EPSS 1,08 % · rekomendacja wg zapisanej polityki
phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local…
Opis źródłowy NVD · ENCVSS 6,8 · rekomendacja wg zapisanej polityki
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,…
Opis źródłowy NVD · ENCVSS 6,8 · rekomendacja wg zapisanej polityki
Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap…
Opis źródłowy NVD · ENCVSS 6,8 · rekomendacja wg zapisanej polityki
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains…
Opis źródłowy NVD · ENCVSS 6,8 · rekomendacja wg zapisanej polityki
Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo,…
Opis źródłowy NVD · ENCVSS 6,6 · EPSS 0,98 % · rekomendacja wg zapisanej polityki
Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to…
Opis źródłowy NVD · ENCVSS 6,6 · EPSS 0,95 % · rekomendacja wg zapisanej polityki
MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitizeEntryName filter. Attackers can craft TAR, 7z or RAR entries named ....//file that become ../file, creating or overwriting…
Opis źródłowy NVD · ENCVSS 6,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
An Out-of-bounds Write vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved allows a local attacker to cause a Denial of Service (DoS) via sending a crafted packet to the eventd relay service.
Opis źródłowy NVD · ENCVSS 6,7 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
A NULL Pointer Dereference vulnerability in the na-grpcd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker with access to the chassis-internal network to cause a denial of service via a network message.
Opis źródłowy NVD · ENCVSS 6,7 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory,…
Opis źródłowy NVD · ENCVSS 6,7 · EPSS 0,14 % · rekomendacja wg zapisanej polityki
Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the…
Opis źródłowy NVD · ENCVSS 6,7 · EPSS 0,14 % · rekomendacja wg zapisanej polityki
Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock.
Opis źródłowy NVD · ENCVSS 6,7 · EPSS 0,14 % · rekomendacja wg zapisanej polityki
Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,6 · EPSS 1,08 % · rekomendacja wg zapisanej polityki
phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local…
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,…
Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap…
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains…
Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,6 · EPSS 0,98 % · rekomendacja wg zapisanej polityki
Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,6 · EPSS 0,95 % · rekomendacja wg zapisanej polityki
MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitizeEntryName filter. Attackers can craft TAR, 7z or RAR entries named ....//file that become ../file, creating or overwriting…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
An Out-of-bounds Write vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved allows a local attacker to cause a Denial of Service (DoS) via sending a crafted packet to the eventd relay service.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,7 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
A NULL Pointer Dereference vulnerability in the na-grpcd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker with access to the chassis-internal network to cause a denial of service via a network message.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,7 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,7 · EPSS 0,14 % · rekomendacja wg zapisanej polityki
Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,7 · EPSS 0,14 % · rekomendacja wg zapisanej polityki
Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,7 · EPSS 0,14 % · rekomendacja wg zapisanej polityki