Baza CVE

Błąd w jądrze Linux umożliwia wykorzystanie po zwolnieniu pamięci, prowadząc do niebezpiecznego dostępu.

In the Linux kernel, the following vulnerability has been resolved: smb: server: let send_done handle a completion without IB_SEND_SIGNALED With smbdirect_send_batch processing we likely…

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the URL ends with Authentication…

Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an authorized attacker to elevate privileges over a network.

Brak sprawdzania długości bufora w Delta Electronics AS320T umożliwia zdalne wykonanie kodu.

Brak sprawdzania długości bufora w Delta Electronics AS320T umożliwia zdalne wykonanie kodu.

Błąd obliczania rozmiaru bufora w Delta Electronics AS320T umożliwia zdalne wykonanie kodu.

Błąd w OP-TEE umożliwia odczyt poza granicami pamięci i awarię systemu.

Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user (including `BASIC` role) can escalate to `ADMIN` on servers migrated from password…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the /config/ < service > /find-in-config endpoint in Roxy-WI fails to…

A vulnerability in  SenseLive X3050’s web management interface allows unauthorized access to certain configuration endpoints due to improper access control enforcement. An attacker with…

A vulnerability in SenseLive X3050’s web management interface allows authentication logic to be performed entirely on the client side, relying on hardcoded values within browser-executed…

A vulnerability exists in SenseLive X3050’s web management interface in which password updates are not reliably applied due to improper handling of credential changes on the backend. After…

A vulnerability in SenseLive X3050’s embedded management service allows full administrative control to be established without any form of authentication or authorization on the SenseLive…

A vulnerability exists in SenseLive X3050's web management interface that allows critical configuration parameters to be modified without sufficient authentication or server-side…

Brak uwierzytelnienia w usłudze zarządzania zdalnego SenseLive X3050 umożliwia nieautoryzowane operacje na firmware.

Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network.

Przekierowanie URL do nieznanej witryny w M365 Copilot umożliwia nieautoryzowanym atakującym eskalację uprawnień.

Deserializacja niezaufanych danych w Microsoft Bing umożliwia zdalne wykonanie kodu.

Wykorzystanie SSRF w Microsoft Purview umożliwia nieautoryzowanemu atakującemu eskalację uprawnień w sieci.

Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.

Wstrzyknięcie poleceń w radare2-mcp umożliwia zdalne wykonanie kodu bez uwierzytelnienia.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Mass Assignment vulnerability in the DocumentStore creation endpoint allows…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the Chatflow configuration file upload settings can be modified to allow the…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the…