Podatności

ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in…

CVSS 4,0 · EPSS 0,4 % · rekomendacja wg zapisanej polityki

The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership.

CVSS 4,0 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

HPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirable behavior.

CVSS 4,0 · EPSS 0,1 % · rekomendacja wg zapisanej polityki

IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system.

CVSS 4,0 · rekomendacja wg zapisanej polityki

eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to…

CVSS 3,8 · EPSS 0,33 % · rekomendacja wg zapisanej polityki

A security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflow.

CVSS 3,8 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel…

CVSS 3,8 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view…

CVSS 3,8 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests

CVSS 3,8 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.

CVSS 3,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::open_stream in httplib.h accepts a caller-controlled path that reaches detail::write_request_line() without the detail::encode_path() protection used by the ordinary buffered request path. Raw carriage-return…

CVSS 3,7 · EPSS 0,37 % · rekomendacja wg zapisanej polityki

Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can submit incremental wildcard patterns such…

CVSS 3,7 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose…

CVSS 3,7 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP…

CVSS 3,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params (customer[uuid])' parameter. This makes it possible for unauthenticated attackers to…

CVSS 3,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or…

CVSS 3,7 · EPSS 0,28 % · rekomendacja wg zapisanej polityki

A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information about files on the device.

CVSS 3,7 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device.

CVSS 3,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or…

CVSS 3,7 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/snippet.php does not apply the standard authenticated-session guard before processing short text preview requests. The endpoint still performs FileRise ACL…

CVSS 3,7 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited…

CVSS 3,7 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct…

CVSS 3,7 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected is the function sha1 of the file App/Home/Model/UserModel.class.php. The manipulation of the argument Password leads to password hash with…

CVSS 3,7 · EPSS 0,2 % · rekomendacja wg zapisanej polityki

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers.

CVSS 3,7 · EPSS 0,19 % · rekomendacja wg zapisanej polityki

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The…

CVSS 3,7 · EPSS 0,18 % · rekomendacja wg zapisanej polityki