KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector may cause a denial of service or…
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory.
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp,…
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass…
Subscriber Broken Access Control in WPSection <= 1.5.1 versions.
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the `create_support_user()` function. This is due to the function identifying the support account solely by matching against…
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as…
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can…
Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.
Unauthenticated Local File Inclusion in Volos <= 1.2 versions.
Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.
Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.
Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.
Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.
Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.
Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.
Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.
Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.
Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.
Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.
Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.
Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal…
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization… | IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. |
Obserwuj | 8,1 | 0,36 % | ||
| IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet… | IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector may cause a denial of service or… |
Obserwuj | 8,1 | 0,36 % | ||
| IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a… | IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory. |
Obserwuj | 8,1 | 0,36 % | ||
| fast-jwt provides fast JSON Web Token (JWT) implementation. | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp,… |
Obserwuj | 8,1 | 0,36 % | ||
| Backstage is an open framework for building developer portals. | Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass… |
Obserwuj | 8,1 | 0,36 % | ||
| Subscriber Broken Access Control in WPSection <= 1.5.1 versions. | Subscriber Broken Access Control in WPSection <= 1.5.1 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up… | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the `create_support_user()` function. This is due to the function identifying the support account solely by matching against… |
Obserwuj | 8,1 | 0,35 % | ||
| Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip… | Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as… |
Obserwuj | 8,1 | 0,35 % | ||
| Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists… | Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can… |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Cardea <= 2.3 versions. | Unauthenticated Local File Inclusion in Cardea <= 2.3 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Volos <= 1.2 versions. | Unauthenticated Local File Inclusion in Volos <= 1.2 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Kaven <= 1.2 versions. | Unauthenticated Local File Inclusion in Kaven <= 1.2 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Teoro <= 1.1 versions. | Unauthenticated Local File Inclusion in Teoro <= 1.1 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Fabius <= 1.0 versions. | Unauthenticated Local File Inclusion in Fabius <= 1.0 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions. | Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions. | Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions. | Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions. | Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in TouchUp < 1.4 versions. | Unauthenticated Local File Inclusion in TouchUp < 1.4 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions. | Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Aalto <= 1.8 versions. | Unauthenticated Local File Inclusion in Aalto <= 1.8 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions. | Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions. | Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions. |
Obserwuj | 8,1 | 0,35 % | ||
| Nginx UI is a web user interface for the Nginx web server. | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal… |
Obserwuj | 8,1 | 0,35 % | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes… | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3. |
Obserwuj | 8,1 | 0,34 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.