Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes uninitialized memory when handling crafted input. Attackers can supply a crafted JPEG file for processing to disclose uninitialized memory…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded. Attackers can supply a crafted PostScript file to expose a single uninitialized byte of memory contents.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured in tracebacks. Attackers who can read error logs can extract plaintext secrets such as credentials or keys exposed in traceback…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
This vulnerability allows an attacker to access parts of the application that are not protected by any type of access control. The attacker could access this path ‘…/epsilonnet/License/About.aspx’ and obtain information on both the licence and the configuration of the product by knowing which…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATE_REQUEST_PDU whose channel name lacks a…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers with high privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Due to an OS Command Injection vulnerability in SAP Business Connector, an authenticated attacker with administrative access and adjacent network access could upload specially crafted content to the server. If processed by the application, this content enables execution of arbitrary operating…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.
This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile._open, when an application calls Image.open() on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint.
To…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts. Attackers can add entries via POST /api/proxies and then use /proxy or /proxy2 to reach…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured directory service.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
CVSS
6,9
EPSS
0,29 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes uninitialized memory when handling crafted input. Attackers can supply a crafted JPEG file for processing to disclose uninitialized memory…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded. Attackers can supply a crafted PostScript file to expose a single uninitialized byte of memory contents.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured in tracebacks. Attackers who can read error logs can extract plaintext secrets such as credentials or keys exposed in traceback…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
This vulnerability allows an attacker to access parts of the application that are not protected by any type of access control. The attacker could access this path ‘…/epsilonnet/License/About.aspx’ and obtain information on both the licence and the configuration of the product by knowing which…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,31 % · rekomendacja wg zapisanej polityki
FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows malicious backend RDP servers to read heap memory out of bounds. Attackers can send a CREATE_REQUEST_PDU whose channel name lacks a…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers with high privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Due to an OS Command Injection vulnerability in SAP Business Connector, an authenticated attacker with administrative access and adjacent network access could upload specially crafted content to the server. If processed by the application, this content enables execution of arbitrary operating…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.
This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile._open, when an application calls Image.open() on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint.
To…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts. Attackers can add entries via POST /api/proxies and then use /proxy or /proxy2 to reach…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured directory service.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
6,9
0,29 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.