Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adl_openFile() or…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played,…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, `EntryPoint::FromStr` in `rattler_conda_types` performs only `.trim()` on the `command` field before the linker joins it onto the install prefix and writes an executable Python script.…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output.
Hex compares a fetched tarball's inner and outer checksums with the repository's signed…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: OIDC). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks require…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle, allowing malformed public or no-secret keysets that violate Tink's keyset…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication.
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn,…
Opis źródłowy NVD · ENCVSS 6,9 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
CVSS
6,9
EPSS
0,18 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adl_openFile() or…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, `EntryPoint::FromStr` in `rattler_conda_types` performs only `.trim()` on the `command` field before the linker joins it onto the install prefix and writes an executable Python script.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output.
Hex compares a fetched tarball's inner and outer checksums with the repository's signed…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: OIDC). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks require…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle, allowing malformed public or no-secret keysets that violate Tink's keyset…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,9 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
6,9
0,18 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.