Publikacje w kolejności czasu

smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer() that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. Attackers can provide an MPEG file whose stream table bytes all set the high bit, which…

CVSS 6,8 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

smpeg through 2.0.0 contains an integer underflow vulnerability in stream_header() in MPEGsystem.cpp that allows attackers to wrap packet_size by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEG_new, SMPEG_new_rwops or SMPEG_new_data to trigger a…

CVSS 6,8 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

libtta through 2.3 contains an integer overflow vulnerability in tta_decoder_init_get_info() that allows attackers to cause a heap buffer overflow on 32-bit builds via unvalidated header fields. Attackers can supply a crafted .tta file with a sample rate of 1 and large samples value, wrapping the…

CVSS 5,8 · EPSS 0,14 % · rekomendacja wg zapisanej polityki

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in tta_decoder_process_stream() and tta_decoder_process_frame() because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses…

CVSS 4,8 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and…

CVSS 7,6 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear…

CVSS 8,6 · EPSS 0,49 % · rekomendacja wg zapisanej polityki

ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to…

CVSS 7,6 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners'…

CVSS 6,0 · EPSS 0,36 % · rekomendacja wg zapisanej polityki

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so…

CVSS 2,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ...…

CVSS 7,7 · EPSS 0,57 % · rekomendacja wg zapisanej polityki

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or…

CVSS 8,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file modules/ui_extra_networks.py of the component Card Builder. The manipulation of the argument filename leads to cross site scripting. It is possible to…

CVSS 2,1 · EPSS 0,46 % · rekomendacja wg zapisanej polityki

A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Metadata Extraction. The manipulation of the argument header length field results in allocation of resources.…

CVSS 2,1 · EPSS 0,55 % · rekomendacja wg zapisanej polityki

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users,…

CVSS 9,3 · EPSS 0,53 % · rekomendacja wg zapisanej polityki

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy…

CVSS 8,7 · EPSS 0,53 % · rekomendacja wg zapisanej polityki

Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.6.

CVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki

Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5.

CVSS 6,5 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32.

CVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.

CVSS 9,8 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.54.

CVSS 8,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1.

CVSS 7,1 · EPSS 0,18 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from n/a through 1.6.13.

CVSS 7,1 · EPSS 0,18 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.

CVSS 9,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29.

CVSS 7,1 · EPSS 0,18 % · rekomendacja wg zapisanej polityki

Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14.

CVSS 6,5 · EPSS 0,24 % · rekomendacja wg zapisanej polityki