KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Przesyłanie tokena sesji i identyfikatora użytkownika w WebView Mira naraża na kradzież danych.
Brak uwierzytelnienia w PraisonAI umożliwia nieautoryzowany dostęp do narzędzi.
Wersje league/commonmark od 2.7.0 do 2.9.0 mają lukę XSS w AttributesExtension, umożliwiającą wstrzyknięcie skryptu.
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered relationship or expressly enabled public API. Inadequately limited templates, including serialization…
The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can…
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold() that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port…
Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHelpForPage, GetRemoteDashboardContent, and…
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and…
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of…
Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary…
Brak autoryzacji w OpenViking pozwala atakującym na dostęp do danych zadań innych użytkowników.
Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement restrictions on SSH port forwarding, allowing to connect to arbitrary destinations. When SSH is enabled on an affected product, SSH port forwarding may be leveraged to connect to other node on the LAN.
SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to…
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.translation.get_supported_language_variant()` is subject to a potential denial-of-service attack when processing many distinct, very long language codes, which are retained as keys in an…
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.http.parse_header_parameters()` was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An…
In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls.
Wstrzyknięcie poleceń w Kenwood DNR1007XR umożliwia zdalne wykonanie kodu przez lokalnego atakującego.
Obejście uwierzytelnienia w rclone umożliwia dostęp do poufnych danych procesów.
Błąd w Biztalk360 umożliwia atakującemu odczyt plików na serwerze przez przejście do katalogu.
A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses to be accepted by manipulating the email field in the /api/method/press.api.account.signup endpoint. The vulnerability occurs when an…
An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information.
SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all…
Błąd zarządzania sesjami w MikroTik RouterOS pozwala na nieautoryzowany dostęp po zmianie uprawnień.
W Admidio przed wersją 5.0.11 występuje podatność na XSS, umożliwiająca atakującym wykonanie kodu w przeglądarkach użytkowników.
The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Przesyłanie tokena sesji i identyfikatora użytkownika w WebView Mira naraża na kradzież danych. | Przesyłanie tokena sesji i identyfikatora użytkownika w WebView Mira naraża na kradzież danych. |
Do wiadomości | 6,9 | 0,39 % | ||
| Brak uwierzytelnienia w PraisonAI umożliwia nieautoryzowany dostęp do narzędzi. | Brak uwierzytelnienia w PraisonAI umożliwia nieautoryzowany dostęp do narzędzi. |
Do wiadomości | 6,9 | 0,39 % | ||
| Wersje league/commonmark od 2.7.0 do 2.9.0 mają lukę XSS w AttributesExtension, umożliwiającą wstrzyknięcie skryptu. | Wersje league/commonmark od 2.7.0 do 2.9.0 mają lukę XSS w AttributesExtension, umożliwiającą wstrzyknięcie skryptu. |
Do wiadomości | 6,9 | 0,39 % | ||
| ApostropheCMS is an open-source Node.js content management system. | ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered relationship or expressly enabled public API. Inadequately limited templates, including serialization… |
Do wiadomości | 6,9 | 0,39 % | ||
| The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. | The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can… |
Do wiadomości | 6,9 | 0,39 % | ||
| Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold() that allows remote… | Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold() that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port… |
Do wiadomości | 6,9 | 0,39 % | ||
| Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in… | Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHelpForPage, GetRemoteDashboardContent, and… |
Do wiadomości | 6,9 | 0,39 % | ||
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary… | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and… |
Do wiadomości | 6,9 | 0,38 % | ||
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release… | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of… |
Do wiadomości | 6,9 | 0,38 % | ||
| Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by… | Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary… |
Do wiadomości | 6,9 | 0,38 % | ||
| Brak autoryzacji w OpenViking pozwala atakującym na dostęp do danych zadań innych użytkowników. | Brak autoryzacji w OpenViking pozwala atakującym na dostęp do danych zadań innych użytkowników. |
Do wiadomości | 6,9 | 0,38 % | ||
| Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. | Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement restrictions on SSH port forwarding, allowing to connect to arbitrary destinations. When SSH is enabled on an affected product, SSH port forwarding may be leveraged to connect to other node on the LAN. |
Do wiadomości | 6,9 | 0,38 % | ||
| SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a… | SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to… |
Do wiadomości | 6,9 | 0,38 % | ||
| An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. | An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.translation.get_supported_language_variant()` is subject to a potential denial-of-service attack when processing many distinct, very long language codes, which are retained as keys in an… |
Do wiadomości | 6,9 | 0,38 % | ||
| An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. | An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.http.parse_header_parameters()` was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An… |
Do wiadomości | 6,9 | 0,38 % | ||
| In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could… | In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls. |
Do wiadomości | 6,9 | 0,38 % | ||
| Wstrzyknięcie poleceń w Kenwood DNR1007XR umożliwia zdalne wykonanie kodu przez lokalnego atakującego. | Wstrzyknięcie poleceń w Kenwood DNR1007XR umożliwia zdalne wykonanie kodu przez lokalnego atakującego. |
Do wiadomości | 6,8 | 0,88 % | ||
| Obejście uwierzytelnienia w rclone umożliwia dostęp do poufnych danych procesów. | Obejście uwierzytelnienia w rclone umożliwia dostęp do poufnych danych procesów. |
Do wiadomości | 6,9 | 0,38 % | ||
| Błąd w Biztalk360 umożliwia atakującemu odczyt plików na serwerze przez przejście do katalogu. | Błąd w Biztalk360 umożliwia atakującemu odczyt plików na serwerze przez przejście do katalogu. |
Do wiadomości | 6,8 | 0,88 % | ||
| A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows… | A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses to be accepted by manipulating the email field in the /api/method/press.api.account.signup endpoint. The vulnerability occurs when an… |
Do wiadomości | 6,9 | 0,38 % | ||
| An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. | An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information. |
Do wiadomości | 6,9 | 0,38 % | ||
| SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous… | SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all… |
Do wiadomości | 6,9 | 0,38 % | ||
| Błąd zarządzania sesjami w MikroTik RouterOS pozwala na nieautoryzowany dostęp po zmianie uprawnień. | Błąd zarządzania sesjami w MikroTik RouterOS pozwala na nieautoryzowany dostęp po zmianie uprawnień. |
Do wiadomości | 6,9 | 0,38 % | ||
| W Admidio przed wersją 5.0.11 występuje podatność na XSS, umożliwiająca atakującym wykonanie kodu w przeglądarkach użytkowników. | W Admidio przed wersją 5.0.11 występuje podatność na XSS, umożliwiająca atakującym wykonanie kodu w przeglądarkach użytkowników. |
Do wiadomości | 6,9 | 0,38 % | ||
| The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. | The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature… |
Do wiadomości | 6,9 | 0,38 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.