Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a `TX_THREAD` control block through `txm_module_object_allocate`; `_txm_module_manager_thread_create` then takes a second allocation of…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks.
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed,…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table.
The overflowed…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns `GX_SUCCESS` and publishes a…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating.…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list advanced its processed-bytes counter even when a record had been rejected as invalid.
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing.
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length.
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
Opis źródłowy NVD · ENCVSS 6,7 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Mobile…
Opis źródłowy NVD · ENCVSS 6,7 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Mobile…
Opis źródłowy NVD · ENCVSS 6,7 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to…
Opis źródłowy NVD · ENCVSS 6,7 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards…
Opis źródłowy NVD · ENCVSS 6,7 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows high privileged attacker with…
Opis źródłowy NVD · ENCVSS 6,7 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows high privileged attacker with…
Opis źródłowy NVD · ENCVSS 6,7 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily…
Opis źródłowy NVD · ENCVSS 6,7 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to…
Opis źródłowy NVD · ENCVSS 6,7 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
CVSS
6,7
EPSS
0,12 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a `TX_THREAD` control block through `txm_module_object_allocate`; `_txm_module_manager_thread_create` then takes a second allocation of…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table.
The overflowed…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns `GX_SUCCESS` and publishes a…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list advanced its processed-bytes counter even when a record had been rejected as invalid.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,7 · EPSS 0,34 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Mobile…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,7 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Mobile…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,7 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,7 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,7 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows high privileged attacker with…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,7 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows high privileged attacker with…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,7 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,7 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,7 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
6,7
0,12 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.