Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail,…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Isar is an integration system for automated root filesystem generation. In versions 0.11-rc1 and 0.11, defining ISAR_APT_SNAPSHOT_DATE alone does not set the correct timestamp value for security distribution, leading to missed security updates. This issue has been patched via commit 738bcbb.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
A vulnerability was identified in wbond certvalidator up to 0.11.1. This issue affects some unknown processing of the component Certificate Path Builder. Such manipulation leads to resource consumption. The attack can be launched remotely. The vendor was contacted early about this disclosure but…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Weibo-created accounts by deriving predictable credentials from public Weibo user IDs. OAuthAccountServiceImp.transferSina() sets the password to the first four digits of the Weibo…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
NewSiteServer (NSS) developed by CyberTutor has a Missing Authentication vulnerability. Unauthenticated remote attackers can exploit a specific functionality to send emails to anyone on behalf of the school.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Isar is an integration system for automated root filesystem generation. In versions 0.11-rc1 and 0.11, defining ISAR_APT_SNAPSHOT_DATE alone does not set the correct timestamp value for security distribution, leading to missed security updates. This issue has been patched via commit 738bcbb.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
A vulnerability was identified in wbond certvalidator up to 0.11.1. This issue affects some unknown processing of the component Certificate Path Builder. Such manipulation leads to resource consumption. The attack can be launched remotely. The vendor was contacted early about this disclosure but…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Weibo-created accounts by deriving predictable credentials from public Weibo user IDs. OAuthAccountServiceImp.transferSina() sets the password to the first four digits of the Weibo…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
NewSiteServer (NSS) developed by CyberTutor has a Missing Authentication vulnerability. Unauthenticated remote attackers can exploit a specific functionality to send emails to anyone on behalf of the school.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,34 % · rekomendacja wg zapisanej polityki