Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Vulnerability in the JD Edwards EnterpriseOne Homebuilder product of Oracle JD Edwards (component: Homebuilder Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
Arcade MCP allows you to to create, deploy, and share MCP Servers. Prior to 1.5.4, the arcade-mcp HTTP server uses a hardcoded default worker secret ("dev") that is never validated or overridden during normal server startup. As a result, any unauthenticated attacker who knows this default key can…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CF_DIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memory with `file.read()`. This occurs before the data is sent to…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit_post_block' and 'jeg_find_author' AJAX actions in versions up to, and including, 3.2.19. The 'wp_ajax_jkit_post_block' handler (registered generically…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
A flaw was found in the automation-controller notification
subsystem. Although NotificationTemplate.notification_
configuration is protected from API filtering, its recipient
value is copied in clear text into the unprotected…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler fixed-slot copy TlmRecv_handler copies val.getSize bytes into entry.channelSize storage without confirming that the…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
CVSS
6,5
EPSS
0,31 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Vulnerability in the JD Edwards EnterpriseOne Homebuilder product of Oracle JD Edwards (component: Homebuilder Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
Arcade MCP allows you to to create, deploy, and share MCP Servers. Prior to 1.5.4, the arcade-mcp HTTP server uses a hardcoded default worker secret ("dev") that is never validated or overridden during normal server startup. As a result, any unauthenticated attacker who knows this default key can…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max_token_id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CF_DIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memory with `file.read()`. This occurs before the data is sent to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit_post_block' and 'jeg_find_author' AJAX actions in versions up to, and including, 3.2.19. The 'wp_ajax_jkit_post_block' handler (registered generically…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
A flaw was found in the automation-controller notification
subsystem. Although NotificationTemplate.notification_
configuration is protected from API filtering, its recipient
value is copied in clear text into the unprotected…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler fixed-slot copy TlmRecv_handler copies val.getSize bytes into entry.channelSize storage without confirming that the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
6,5
0,31 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.