Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the 'jay_login_register_process_switch_back' cookie value.…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 3,25 % · rekomendacja wg zapisanej polityki
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth: reject short AUTH_RECEIVE buffers
nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length
after checking only that it is nonzero and matches the transfer length.
In the SUCCESS1 and FAILURE1/default…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
gue: validate REMCSUM private option length
GUE private flags can indicate that remote checksum offload metadata is
present. The private flags field itself is accounted for by
guehdr_flags_len(), but guehdr_priv_flags_len()…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
qede: fix off-by-one in BD ring consumption on build_skb failure
qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a
NULL return from qede_build_skb(). When it returns NULL under memory
pressure, the functions…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. Attackers can modify configurations without authentication, potentially manipulating active runway settings and misleading air traffic control (ATC) and pilots.…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
A vulnerability was identified in Tenda AC21 16.03.08.16. This vulnerability affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg. The manipulation of the argument startIp leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and pre-sanitization…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the 'jay_login_register_process_switch_back' cookie value.…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 3,25 % · rekomendacja wg zapisanej polityki
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth: reject short AUTH_RECEIVE buffers
nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length
after checking only that it is nonzero and matches the transfer length.
In the SUCCESS1 and FAILURE1/default…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
gue: validate REMCSUM private option length
GUE private flags can indicate that remote checksum offload metadata is
present. The private flags field itself is accounted for by
guehdr_flags_len(), but guehdr_priv_flags_len()…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
qede: fix off-by-one in BD ring consumption on build_skb failure
qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a
NULL return from qede_build_skb(). When it returns NULL under memory
pressure, the functions…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. Attackers can modify configurations without authentication, potentially manipulating active runway settings and misleading air traffic control (ATC) and pilots.…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,75 % · rekomendacja wg zapisanej polityki
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
A vulnerability was identified in Tenda AC21 16.03.08.16. This vulnerability affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg. The manipulation of the argument startIp leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly…
Opis źródłowy NVD · EN
Pilne działanie
CVSS 9,8 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and pre-sanitization…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,74 % · rekomendacja wg zapisanej polityki