Chronologiczny przegląd publikacji. Ostatnie modyfikacje są w osobnym widoku.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params (customer[uuid])' parameter. This makes it possible for unauthenticated attackers to…
Opis źródłowy NVD · ENCVSS 3,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,47 % · rekomendacja wg zapisanej polityki
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,86 % · rekomendacja wg zapisanej polityki
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access…
Opis źródłowy NVD · ENCVSS 8,1 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Depending…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image,…
Opis źródłowy NVD · ENCVSS 6,6 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized…
Opis źródłowy NVD · ENCVSS 5,5 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory…
Opis źródłowy NVD · ENCVSS 5,9 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace.
Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.
When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage…
Opis źródłowy NVD · ENCVSS 6,6 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function…
Opis źródłowy NVD · ENCVSS 3,6 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.
fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline.
With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline.
getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.
With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.
When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine.
combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid…
Opis źródłowy NVD · ENCVSS 4,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers…
Opis źródłowy NVD · ENCVSS 7,5 · EPSS 0,91 % · rekomendacja wg zapisanej polityki
A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file…
Opis źródłowy NVD · ENCVSS 6,1 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading…
Opis źródłowy NVD · ENCVSS 7,0 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
CVSS
7,0
EPSS
0,18 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params (customer[uuid])' parameter. This makes it possible for unauthenticated attackers to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,7 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,47 % · rekomendacja wg zapisanej polityki
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,86 % · rekomendacja wg zapisanej polityki
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,1 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Depending…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,6 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,5 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,9 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace.
Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.
When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,6 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 3,6 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.
fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline.
With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline.
getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.
With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.
When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine.
combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 4,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,5 · EPSS 0,91 % · rekomendacja wg zapisanej polityki
A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,1 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,0 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
7,0
0,18 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.