KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request…
In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object…
CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java blocks the RFC 6052 64:ff9b::/96 NAT64 prefix but omits the…
Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled (graphQLPublicIntrospection: false, the default), schema-derived 'Did you mean ...?' suggestions were still…
SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/import endpoint. Attackers can supply non-numeric input-dimensions or other…
Podatność w SurrealDB umożliwia atakującym zablokowanie serwera przez nieprawidłowe role użytkowników.
The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses after DNS resolution. IPv6 transition addresses (NAT64 `64:ff9b::/96`, 6to4 `2002::/16`, Teredo `2001:0000::/32`) are classified as globally routable by IANA, so `is_global` returns…
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities.
Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.
NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve…
Wstrzyknięcie poleceń w NVIDIA UFM Enterprise umożliwia zdalne wykonanie kodu przez atakującego.
Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordings_path via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending…
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager, retain session entries without…
Błąd w Blueprint Studio umożliwia przechowywanie tokenów Git w pliku tekstowym, co naraża je na odczyt przez inne procesy.
Przepełnienie bufora w IEC 60870-5-104 umożliwia zdalne wykonanie kodu.
Przepełnienie bufora w IEC 60870-5-104 umożliwia zdalne wykonanie kodu.
NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed…
A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to user enumeration due to distinguishable responses. This could allow an unauthenticated remote attacker to determine if a user is valid or not, enabling a brute force attack…
Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions.
A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device Kit - arm64 V1.11, Industrial Edge Device Kit - arm64 V1.12, Industrial Edge Device Kit - arm64 V1.13, Industrial Edge Device Kit - arm64 V1.14, Industrial…
Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and…
Brak restrykcji przy tworzeniu kont w StoaChat pozwala na tworzenie nieograniczonej liczby kont.
Wstrzyknięcie poleceń w D-Link DCS-933L umożliwia zdalne wykonanie kodu.
Luka ujawnienia informacji w TheHive pozwala na dostęp do wrażliwych danych bez uwierzytelnienia.
json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. | A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request… |
Do wiadomości | 6,9 | 0,48 % | ||
| In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. | In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object… |
Do wiadomości | 6,9 | 0,48 % | ||
| CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. | CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java blocks the RFC 6052 64:ff9b::/96 NAT64 prefix but omits the… |
Do wiadomości | 6,9 | 0,47 % | ||
| Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. | Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled (graphQLPublicIntrospection: false, the default), schema-derived 'Did you mean ...?' suggestions were still… |
Do wiadomości | 6,9 | 0,47 % | ||
| SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated… | SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/import endpoint. Attackers can supply non-numeric input-dimensions or other… |
Do wiadomości | 6,9 | 0,47 % | ||
| Podatność w SurrealDB umożliwia atakującym zablokowanie serwera przez nieprawidłowe role użytkowników. | Podatność w SurrealDB umożliwia atakującym zablokowanie serwera przez nieprawidłowe role użytkowników. |
Do wiadomości | 6,9 | 0,47 % | ||
| The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses after DNS resolution.… | The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses after DNS resolution. IPv6 transition addresses (NAT64 `64:ff9b::/96`, 6to4 `2002::/16`, Teredo `2001:0000::/32`) are classified as globally routable by IANA, so `is_global` returns… |
Do wiadomości | 6,9 | 0,47 % | ||
| Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and… | Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities. |
Do wiadomości | 6,9 | 0,47 % | ||
| Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the… | Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service. |
Do wiadomości | 6,9 | 0,47 % | ||
| NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction… | NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve… |
Do wiadomości | 6,9 | 0,46 % | ||
| Wstrzyknięcie poleceń w NVIDIA UFM Enterprise umożliwia zdalne wykonanie kodu przez atakującego. | Wstrzyknięcie poleceń w NVIDIA UFM Enterprise umożliwia zdalne wykonanie kodu przez atakującego. |
Do wiadomości | 6,8 | 0,97 % | ||
| Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers… | Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordings_path via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending… |
Do wiadomości | 6,9 | 0,46 % | ||
| The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). | The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager, retain session entries without… |
Do wiadomości | 6,9 | 0,46 % | ||
| Błąd w Blueprint Studio umożliwia przechowywanie tokenów Git w pliku tekstowym, co naraża je na odczyt przez inne procesy. | Błąd w Blueprint Studio umożliwia przechowywanie tokenów Git w pliku tekstowym, co naraża je na odczyt przez inne procesy. |
Do wiadomości | 6,9 | 0,46 % | ||
| Przepełnienie bufora w IEC 60870-5-104 umożliwia zdalne wykonanie kodu. | Przepełnienie bufora w IEC 60870-5-104 umożliwia zdalne wykonanie kodu. |
Do wiadomości | 6,9 | 0,46 % | ||
| Przepełnienie bufora w IEC 60870-5-104 umożliwia zdalne wykonanie kodu. | Przepełnienie bufora w IEC 60870-5-104 umożliwia zdalne wykonanie kodu. |
Do wiadomości | 6,9 | 0,46 % | ||
| NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated… | NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed… |
Do wiadomości | 6,9 | 0,46 % | ||
| A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). | A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to user enumeration due to distinguishable responses. This could allow an unauthenticated remote attacker to determine if a user is valid or not, enabling a brute force attack… |
Do wiadomości | 6,9 | 0,46 % | ||
| Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5 - The front-end Submissions view did… | Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions. |
Do wiadomości | 6,9 | 0,45 % | ||
| A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge… | A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device Kit - arm64 V1.11, Industrial Edge Device Kit - arm64 V1.12, Industrial Edge Device Kit - arm64 V1.13, Industrial Edge Device Kit - arm64 V1.14, Industrial… |
Do wiadomości | 6,9 | 0,45 % | ||
| Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client… | Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and… |
Do wiadomości | 6,9 | 0,45 % | ||
| Brak restrykcji przy tworzeniu kont w StoaChat pozwala na tworzenie nieograniczonej liczby kont. | Brak restrykcji przy tworzeniu kont w StoaChat pozwala na tworzenie nieograniczonej liczby kont. |
Do wiadomości | 6,9 | 0,45 % | ||
| Wstrzyknięcie poleceń w D-Link DCS-933L umożliwia zdalne wykonanie kodu. | Wstrzyknięcie poleceń w D-Link DCS-933L umożliwia zdalne wykonanie kodu. |
Do wiadomości | 6,3 | 3,45 % | ||
| Luka ujawnienia informacji w TheHive pozwala na dostęp do wrażliwych danych bez uwierzytelnienia. | Luka ujawnienia informacji w TheHive pozwala na dostęp do wrażliwych danych bez uwierzytelnienia. |
Do wiadomości | 6,9 | 0,45 % | ||
| json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks… | json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating… |
Do wiadomości | 6,9 | 0,45 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.