Chronologiczny przegląd publikacji. Ostatnie modyfikacje są w osobnym widoku.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly…
Opis źródłowy NVD · ENCVSS 8,2 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the…
Opis źródłowy NVD · ENCVSS 4,2 · EPSS 0,1 % · rekomendacja wg zapisanej polityki
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1.
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitrary code via the mepCode parameter of the /ssb/registration endpoint
Opis źródłowy NVD · ENCVSS 6,1 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected is the function mysqli_query of the file doedit.php of the component Registration-Edit Handler. This manipulation of the argument…
Opis źródłowy NVD · ENCVSS 7,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component Registration-Delete Handler. Such manipulation of the argument ID leads to sql…
Opis źródłowy NVD · ENCVSS 5,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.7.
Opis źródłowy NVD · ENCVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.57.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.4.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and…
Opis źródłowy NVD · ENCVSS 7,4 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit…
Opis źródłowy NVD · ENCVSS 6,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A flaw has been found in diem-project diem up to 5.1.3. The impacted element is the function dmOs::join of the file dmFrontPlugin/modules/dmCodeEditor/actions/actions.class.php of the component dmCodeEditor. Executing a manipulation can lead to path traversal. The attack can be launched remotely.…
Opis źródłowy NVD · ENCVSS 2,0 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file admindocview.php of the component Administrative Mutation Handler. The manipulation of the argument docid leads to sql…
Opis źródłowy NVD · ENCVSS 5,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function _get_lib_module of the file python/mlc_chat/chat_module.py. The manipulation of the argument model_lib results in code injection. The attack may be launched remotely.…
Opis źródłowy NVD · ENCVSS 2,1 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the…
Opis źródłowy NVD · ENCVSS 6,0 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data_offsets causes buffer overflow. The attack can be initiated…
Opis źródłowy NVD · ENCVSS 2,1 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a…
Opis źródłowy NVD · ENCVSS 4,8 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
CVSS
4,8
EPSS
0,31 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,2 · EPSS 0,46 % · rekomendacja wg zapisanej polityki
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,2 · EPSS 0,1 % · rekomendacja wg zapisanej polityki
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitrary code via the mepCode parameter of the /ssb/registration endpoint
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,1 · EPSS 0,36 % · rekomendacja wg zapisanej polityki
A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected is the function mysqli_query of the file doedit.php of the component Registration-Edit Handler. This manipulation of the argument…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component Registration-Delete Handler. Such manipulation of the argument ID leads to sql…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.7.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.57.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.4.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,4 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,32 % · rekomendacja wg zapisanej polityki
A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,3 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A flaw has been found in diem-project diem up to 5.1.3. The impacted element is the function dmOs::join of the file dmFrontPlugin/modules/dmCodeEditor/actions/actions.class.php of the component dmCodeEditor. Executing a manipulation can lead to path traversal. The attack can be launched remotely.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,0 · EPSS 0,33 % · rekomendacja wg zapisanej polityki
A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file admindocview.php of the component Administrative Mutation Handler. The manipulation of the argument docid leads to sql…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function _get_lib_module of the file python/mlc_chat/chat_module.py. The manipulation of the argument model_lib results in code injection. The attack may be launched remotely.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,1 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,0 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data_offsets causes buffer overflow. The attack can be initiated…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 2,1 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,8 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
4,8
0,31 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.