Baza CVE

Przepełnienie bufora w tildearrow furnace umożliwia zdalne wykonanie kodu.

Przepełnienie bufora w azerothcore-wotlk umożliwia zdalne wykonanie kodu.

ASDA-Soft Stack-based Buffer Overflow Vulnerability

Brak sanitizacji nazw plików w HUSTOF umożliwia zdalne wykonanie kodu przez złośliwe archiwa ZIP.

Wykorzystanie niezaufanego XML w AssertJ umożliwia odczyt lokalnych plików i ataki SSRF.

dcap-qvl implements the quote verification logic for DCAP (Data Center Attestation Primitives). A vulnerability present in versions prior to 0.3.9 involves a critical gap in the cryptographic verification process within the dcap-qvl. The library fetches QE Identity collateral (including…

Brak ograniczeń w Tenda W30E V2 umożliwia nieograniczone próby brute-force na hasła administratora.

Domyślne hasło w firmware Tenda W30E V2 umożliwia nieautoryzowany dostęp do interfejsu zarządzania.

** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum. This issue affects Apache Continuum: all versions. Attackers with access to the installations REST API can use this to invoke arbitrary commands…

The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions. In this new hardware revision it was noticed that an SSH service is exposed on port 22. By analyzing the firmware of the devices, it was noticed that there are two users…

By default, the password for the Access Manager's web interface, is set to 'admin'. In the tested version changing the password was not enforced.

The exos 9300 application can be used to configure Access Managers (e.g. 92xx, 9230 and 9290). The configuration is done in a graphical user interface on the dormakaba exos server. As soon as the save button is clicked in exos 9300, the whole configuration is sent to the selected Access Manager…

On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the 2FA PINs associated with the enrolled…

Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005. This server is used for relaying status information from and to the Access Managers. This information, among other things, is used to graphically…

A vulnerability was found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function portValidate of the file /fort/ip_and_port/port_validate of the component HTTP POST Request Handler. Performing a manipulation of the argument port results in command…

The Kalrav AI Agent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the kalrav_upload_file AJAX action in all versions up to, and including, 2.3.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected…

A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the…

Błąd w iccDEV umożliwia atakującym wykonanie kodu i manipulację danymi.

Niebezpieczne przetwarzanie danych w iccDEV może prowadzić do DoS i wykonania kodu.

Przepełnienie bufora w iccDEV umożliwia zdalne wykonanie kodu i manipulację danymi.

Niebezpieczne przetwarzanie danych w iccDEV może prowadzić do DoS i wykonania kodu.

Przepełnienie bufora w iccDEV umożliwia zdalne wykonanie kodu i manipulację danymi.

Niebezpieczne przetwarzanie danych w iccDEV może prowadzić do DoS i wykonania kodu.

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud…