Baza CVE

Warunek wyścigu w systemach Apple pozwala na obejście ograniczeń sandboxa.

Niebezpieczna deserializacja w manga-image-translator umożliwia zdalne wykonanie kodu.

Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code replay attack.

Przepełnienie bufora w PJSIP umożliwia zdalne wykonanie kodu przez długie nazwy użytkowników.

Obejście zabezpieczeń w Kanboard umożliwia zdalne wykonanie kodu przez administratora.

Chevereto 3.13.4 Core contains a remote code execution vulnerability that allows attackers to inject malicious code during database configuration installation. Attackers can manipulate the database table prefix parameter to write a PHP shell file and execute arbitrary system commands through a…

AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the…

ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by predicting backup filename patterns. Attackers can generate a list of 6-digit PIN combinations and fuzz the backup download URL to exfiltrate sensitive database…

AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials…

An issue was discovered in OpenSatKit 2.2.1. The EventErrStr buffer has a fixed size of 256 bytes. The code uses sprintf to format two filenames (Source1Filename and the string returned by FileUtil_FileStateStr) into this buffer without any length checking and without using bounded format…

Niechroniony punkt końcowy API pozwala zdalnie zmienić hasło urządzenia bez uwierzytelnienia.

Obejście uwierzytelnienia w ZLAN5143D umożliwia dostęp do wewnętrznych URL-i.

A path traversal vulnerability in the check_token function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to bypass authentication and perform administrative actions by supplying a crafted session cookie value.

Brak uwierzytelnienia w urządzeniach METIS WIC umożliwia zdalne wykonanie poleceń systemowych.

Brak uwierzytelnienia w interfejsie webowym METIS DFS umożliwia zdalne wykonanie poleceń z uprawnieniami daemona.

Błąd w Logo j-Platform umożliwia dostęp do wrażliwych informacji przez niewłaściwą konfigurację.

Mikogo 5.2.2.150317 contains an unquoted service path vulnerability in the Mikogo-Service Windows service configuration. Attackers can exploit the unquoted path to inject and execute malicious code with LocalSystem privileges by placing executable files in specific path locations.

Wstrzyknięcie skryptów w Turboard umożliwia atak typu XSS.

A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to traverse the file system to unintended locations. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3350 build…

Brak uwierzytelnienia w Dinosoft ERP umożliwia dostęp do funkcji bez odpowiednich ograniczeń.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to steal tokens and access private repositories by abusing incomplete validation in the Web IDE.

The Custom Block Builder – Lazy Blocks plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.0 via multiple functions in the 'LazyBlocks_Blocks' class. This makes it possible for authenticated attackers, with Contributor-level access and above, to…

Wykonanie poleceń w Catalyst umożliwia zdalne wykonanie kodu z uprawnieniami roota.

Brak informacji o parametrach narzędzi w Zed umożliwia użycie niepożądanych wartości.

Wstrzyknięcie SQL w Worklenz umożliwia nieautoryzowany dostęp do danych.