Publikacje w kolejności czasu

SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift…

CVSS 7,0 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

CVSS 5,4 · EPSS 0,18 % · rekomendacja wg zapisanej polityki

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

CVSS 5,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.

CVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to execute arbitrary code via the HUION driver installer DLL-loading logic

CVSS 7,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not validate the resulting quantity and passes it to the stock update query, increasing inventory and…

CVSS 5,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant.

CVSS 7,1 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made…

CVSS 5,5 · EPSS 0,43 % · rekomendacja wg zapisanej polityki

Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data. Users must upgrade to Cloud Run MCP version 1.11.0 or later.

CVSS 7,7 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the {{update-team-member-roles}} REST API..…

CVSS 3,8 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a…

CVSS 6,3 · EPSS 0,35 % · rekomendacja wg zapisanej polityki

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers…

CVSS 2,3 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this…

CVSS 8,2 · EPSS 0,4 % · rekomendacja wg zapisanej polityki

netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read…

CVSS 8,2 · EPSS 0,46 % · rekomendacja wg zapisanej polityki

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail…

CVSS 8,2 · EPSS 0,49 % · rekomendacja wg zapisanej polityki

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate…

CVSS 6,9 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network…

CVSS 8,7 · EPSS 0,39 % · rekomendacja wg zapisanej polityki

A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The attack can be initiated remotely. The…

CVSS 6,9 · EPSS 0,58 % · rekomendacja wg zapisanej polityki

A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Such manipulation of the argument state/labels leads to os command injection. The attack can be launched remotely. Upgrading…

CVSS 5,3 · EPSS 1,39 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Magepeople inc. WpEvently mage-eventpress allows Code Injection.This issue affects WpEvently: from n/a through 5.7.9.

CVSS 5,3 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query…

CVSS 7,5 · EPSS 0,5 % · rekomendacja wg zapisanej polityki

Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentication out-of-bounds read in SNMP processing

CVSS 5,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki

Arm Keil MDK-Middleware 8.3.0 may allow out-of-bounds reads and writes to the FTP Server RX Buffer

CVSS 6,5 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and Unintended Data Retransmission

CVSS 6,5 · EPSS 0,35 % · rekomendacja wg zapisanej polityki

**UNSUPPORTED WHEN ASSIGNED**  Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library. As this project is retired, we do not plan to…

CVSS 7,5 · EPSS 0,47 % · rekomendacja wg zapisanej polityki