Podatności

vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the…

CVSS 6,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a…

CVSS 6,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG <use> reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes() normalizes mixed-case names. An attacker can provide…

CVSS 6,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. A guest can trigger the issue by registering an event queue with parameters that request messages from an unsubscribed…

CVSS 6,5 · EPSS 0,42 % · rekomendacja wg zapisanej polityki

Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally.

CVSS 6,5 · EPSS 0,41 % · rekomendacja wg zapisanej polityki

TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional…

CVSS 6,5 · EPSS 0,41 % · rekomendacja wg zapisanej polityki

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions.

CVSS 6,5 · EPSS 0,41 % · rekomendacja wg zapisanej polityki

Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.

CVSS 6,5 · EPSS 0,4 % · rekomendacja wg zapisanej polityki

Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.

CVSS 6,5 · EPSS 0,4 % · rekomendacja wg zapisanej polityki

Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally.

CVSS 6,5 · EPSS 0,39 % · rekomendacja wg zapisanej polityki

Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally.

CVSS 6,5 · EPSS 0,39 % · rekomendacja wg zapisanej polityki

kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's join discards the base…

CVSS 6,5 · EPSS 0,39 % · rekomendacja wg zapisanej polityki

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise tracks failed logins only by the combination of source IP address and username. A remote unauthenticated attacker can rotate usernames to obtain a fresh per-account…

CVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

CVSS 6,5 · EPSS 0,37 % · rekomendacja wg zapisanej polityki

A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of an internal structure. An attacker could…

CVSS 6,5 · EPSS 0,36 % · rekomendacja wg zapisanej polityki

A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station…

CVSS 6,5 · EPSS 0,36 % · rekomendacja wg zapisanej polityki

A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station…

CVSS 6,5 · EPSS 0,36 % · rekomendacja wg zapisanej polityki

Improper authorization in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.

CVSS 6,5 · EPSS 0,36 % · rekomendacja wg zapisanej polityki

The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wsp_get_posts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate() method accepts any…

CVSS 6,5 · EPSS 0,35 % · rekomendacja wg zapisanej polityki

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IA_NA options.…

CVSS 6,5 · EPSS 0,35 % · rekomendacja wg zapisanej polityki

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the search_name and search_email GET parameters into both the user-list query and the COUNT query used for pagination without…

CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head…

CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because the wrapping sum bypasses file-range validation, becomes m_endOffset, and leaves…

CVSS 6,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. Prior to 3.0.3, both the getDocumentContent GraphQL query and GET /api/documentapi/{documentapi}/document/{documentId}/content REST…

CVSS 6,5 · EPSS 0,33 % · rekomendacja wg zapisanej polityki

A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking…

CVSS 6,5 · EPSS 0,33 % · rekomendacja wg zapisanej polityki