Podatności

libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a…

CVSS 6,1 · rekomendacja wg zapisanej polityki

@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide,…

CVSS 6,0 · EPSS 0,38 % · rekomendacja wg zapisanej polityki

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17-lts, JumpServer's Ansible-based automation rendering can evaluate attacker-controlled template expressions from users who have permission to create or execute affected automation…

CVSS 6,0 · EPSS 0,38 % · rekomendacja wg zapisanej polityki

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext…

CVSS 6,0 · EPSS 0,36 % · rekomendacja wg zapisanej polityki

Uncontrolled resource consumption in RPC Endpoint Mapper Service allows an unauthorized attacker to deny service over a network.

CVSS 5,9 · EPSS 0,84 % · rekomendacja wg zapisanej polityki

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated…

CVSS 6,0 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback address temporal://internal is reserved for callbacks…

CVSS 6,0 · EPSS 0,33 % · rekomendacja wg zapisanej polityki

Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.

CVSS 5,9 · EPSS 0,82 % · rekomendacja wg zapisanej polityki

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named __proto__…

CVSS 6,0 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 5,9 · EPSS 0,8 % · rekomendacja wg zapisanej polityki

EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the…

CVSS 6,0 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this…

CVSS 5,9 · EPSS 0,77 % · rekomendacja wg zapisanej polityki

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of…

CVSS 5,9 · EPSS 0,77 % · rekomendacja wg zapisanej polityki

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CF_DIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash.

CVSS 6,0 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set in nego_process_negotiation_response(), allowing a security protocol downgrade. A malicious server or man-in-the-middle can select RDSTLS to override…

CVSS 6,0 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client.

CVSS 6,0 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks the buffer to 32 bytes while keeping a pre-filled suggested username's length as its write offset. A malicious or compromised ARM routing service can return a long redirectedUsername…

CVSS 6,0 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocations and reconfigure…

CVSS 6,0 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored filename, following a basename plus millisecond-timestamp…

CVSS 6,0 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable time-ordered Snowflake file IDs, since…

CVSS 6,0 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface() wraps in 32-bit arithmetic and is skipped. A malicious RDP server can send a negative topLevelLeft to clients connecting…

CVSS 6,0 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to…

CVSS 6,0 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERB_RPC_INTERNAL_NAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCount of two or more ending before the…

CVSS 6,0 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Malicious or compromised RDP servers can send crafted unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq…

CVSS 6,0 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can…

CVSS 6,0 · EPSS 0,22 % · rekomendacja wg zapisanej polityki