Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been published and may be used.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the import-csv REST API endpoint in all versions up to, and including, 2.3.1. This is due to the endpoint using `upload_files`…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
In multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation.
This issue affects MStore API: from n/a through 4.18.4.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
In NrmmMsgCodec::DecodeUPUTransparentContext of cn_NrmmDecoder.cpp, there is a possible out-of-bounds read due to memory corruption. This could lead to remote denial of service causing a communication processor crash with no additional execution privileges needed. User interaction is not needed…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP addresses as proxies (TrustedProxies = 0.0.0.0/0), allowing any client to spoof the X-Forwarded-For header. Since all IP-based access…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization flaw in the comment creation endpoint allows authenticated users to impersonate any other user by altering the authorName field in the API request. This enables attackers to post comments…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
CVSS
6,5
EPSS
0,25 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been published and may be used.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the import-csv REST API endpoint in all versions up to, and including, 2.3.1. This is due to the endpoint using `upload_files`…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
In multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation.
This issue affects MStore API: from n/a through 4.18.4.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
In NrmmMsgCodec::DecodeUPUTransparentContext of cn_NrmmDecoder.cpp, there is a possible out-of-bounds read due to memory corruption. This could lead to remote denial of service causing a communication processor crash with no additional execution privileges needed. User interaction is not needed…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP addresses as proxies (TrustedProxies = 0.0.0.0/0), allowing any client to spoof the X-Forwarded-For header. Since all IP-based access…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization flaw in the comment creation endpoint allows authenticated users to impersonate any other user by altering the authorName field in the API request. This enables attackers to post comments…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
6,5
0,25 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.