Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,71 % · rekomendacja wg zapisanej polityki
A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special
Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request
Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in
administrator into visiting a phishing website, causing the router to execute
arbitrary commands with root…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 1,21 % · rekomendacja wg zapisanej polityki
JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,71 % · rekomendacja wg zapisanej polityki
The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated struct osdp_event. For the REPLY_KEYPPAD and REPLY_RAW reply types, the payload length is taken from the received frame and the only validation…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery.
This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,71 % · rekomendacja wg zapisanej polityki
A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Improper Neutralization of Special
Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request
Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in
administrator into visiting a phishing website, causing the router to execute
arbitrary commands with root…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 1,21 % · rekomendacja wg zapisanej polityki
JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,71 % · rekomendacja wg zapisanej polityki
The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated struct osdp_event. For the REPLY_KEYPPAD and REPLY_RAW reply types, the payload length is taken from the received frame and the only validation…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery.
This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,2 % · rekomendacja wg zapisanej polityki