Chronologiczny przegląd publikacji. Ostatnie modyfikacje są w osobnym widoku.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning, but doesn't track the cumulative size as multiple segments arrive. An attacker can declare a…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
SOEM version 2.0.0 and earlier contains a vulnerability during device configuration where a malicious device can cause memory corruption. The software writes configuration data to a fixed-size array without checking if the array index exceeds its maximum size of EC_MAXFMMU entries. A device…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an error response, it clears an internal pointer but continues processing. If another message arrives before timeout, the software attempts to use the cleared…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages without validating them against buffer sizes. This can cause…
Opis źródłowy NVD · ENCVSS 7,1 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component.
This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2.
DoclingProducer builds the command line of the external docling tool and…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component.
This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2.
DoclingProducer runs the external docling tool in CLI mode, the default, and…
Opis źródłowy NVD · ENCVSS 5,4 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd_options leads to unrestricted upload. The attack may be launched…
Opis źródłowy NVD · ENCVSS 7,3 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The original logic only explicitly handled…
Opis źródłowy NVD · ENCVSS 7,7 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing…
Opis źródłowy NVD · ENCVSS 8,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.6.
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link.
Opis źródłowy NVD · ENCVSS 5,6 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2.
When the CoAP consumer could not build its response once the route had completed, CamelCoapResource…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action.
Under attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and…
Opis źródłowy NVD · ENCVSS 7,6 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
A vulnerability was determined in ffxiv-teamcraft FFXIV Teamcraft up to 11.4.31. Impacted is the function clipboard.readText of the file apps/electron/src/preload.ts of the component Renderer-Process IPC Bridge. This manipulation causes cross site scripting. The attack is possible to be carried…
Opis źródłowy NVD · ENCVSS 2,0 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to deserialization. The attack may be performed from remote. Upgrading to version 1.24.0.4 is…
Opis źródłowy NVD · ENCVSS 7,8 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initiate the attack remotely. The exploit has been released to…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch the attack remotely. The exploit has been made available to…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The…
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file app/del.php. Executing a manipulation of the argument hash can lead to improper privilege management. The attack can be launched remotely. The exploit has been published and may be used.…
Opis źródłowy NVD · ENCVSS 5,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
CVSS
5,5
EPSS
0,34 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning, but doesn't track the cumulative size as multiple segments arrive. An attacker can declare a…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
SOEM version 2.0.0 and earlier contains a vulnerability during device configuration where a malicious device can cause memory corruption. The software writes configuration data to a fixed-size array without checking if the array index exceeds its maximum size of EC_MAXFMMU entries. A device…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an error response, it clears an internal pointer but continues processing. If another message arrives before timeout, the software attempts to use the cleared…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages without validating them against buffer sizes. This can cause…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,1 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component.
This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2.
DoclingProducer builds the command line of the external docling tool and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component.
This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2.
DoclingProducer runs the external docling tool in CLI mode, the default, and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,4 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd_options leads to unrestricted upload. The attack may be launched…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,3 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The original logic only explicitly handled…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,7 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.6.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,6 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2.
When the CoAP consumer could not build its response once the route had completed, CamelCoapResource…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action.
Under attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,6 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
A vulnerability was determined in ffxiv-teamcraft FFXIV Teamcraft up to 11.4.31. Impacted is the function clipboard.readText of the file apps/electron/src/preload.ts of the component Renderer-Process IPC Bridge. This manipulation causes cross site scripting. The attack is possible to be carried…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,0 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to deserialization. The attack may be performed from remote. Upgrading to version 1.24.0.4 is…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,8 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initiate the attack remotely. The exploit has been released to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch the attack remotely. The exploit has been made available to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file app/del.php. Executing a manipulation of the argument hash can lead to improper privilege management. The attack can be launched remotely. The exploit has been published and may be used.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,5 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
5,5
0,34 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.