KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow.
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and restore_nginx_ui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create…
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector may cause a denial of service or…
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory.
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp,…
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass…
Subscriber Broken Access Control in WPSection <= 1.5.1 versions.
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the `create_support_user()` function. This is due to the function identifying the support account solely by matching against…
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as…
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can…
Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.
Unauthenticated Local File Inclusion in Volos <= 1.2 versions.
Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.
Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.
Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.
Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.
Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.
Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.
Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.
Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.
Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.
Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. |
Obserwuj | 8,1 | 0,37 % | ||
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could… | IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow. |
Obserwuj | 8,1 | 0,37 % | ||
| Nginx UI is a web user interface for the Nginx web server. | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and restore_nginx_ui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create… |
Obserwuj | 8,1 | 0,36 % | ||
| IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer… | IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow. |
Obserwuj | 8,1 | 0,36 % | ||
| IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization… | IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. |
Obserwuj | 8,1 | 0,36 % | ||
| IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet… | IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector may cause a denial of service or… |
Obserwuj | 8,1 | 0,36 % | ||
| IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a… | IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory. |
Obserwuj | 8,1 | 0,36 % | ||
| fast-jwt provides fast JSON Web Token (JWT) implementation. | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp,… |
Obserwuj | 8,1 | 0,36 % | ||
| Backstage is an open framework for building developer portals. | Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass… |
Obserwuj | 8,1 | 0,36 % | ||
| Subscriber Broken Access Control in WPSection <= 1.5.1 versions. | Subscriber Broken Access Control in WPSection <= 1.5.1 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up… | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the `create_support_user()` function. This is due to the function identifying the support account solely by matching against… |
Obserwuj | 8,1 | 0,35 % | ||
| Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip… | Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as… |
Obserwuj | 8,1 | 0,35 % | ||
| Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists… | Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can… |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Cardea <= 2.3 versions. | Unauthenticated Local File Inclusion in Cardea <= 2.3 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Volos <= 1.2 versions. | Unauthenticated Local File Inclusion in Volos <= 1.2 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Kaven <= 1.2 versions. | Unauthenticated Local File Inclusion in Kaven <= 1.2 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Teoro <= 1.1 versions. | Unauthenticated Local File Inclusion in Teoro <= 1.1 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Fabius <= 1.0 versions. | Unauthenticated Local File Inclusion in Fabius <= 1.0 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions. | Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions. | Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions. | Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions. | Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in TouchUp < 1.4 versions. | Unauthenticated Local File Inclusion in TouchUp < 1.4 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions. | Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Aalto <= 1.8 versions. | Unauthenticated Local File Inclusion in Aalto <= 1.8 versions. |
Obserwuj | 8,1 | 0,35 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.