Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending a crafted filename containing directory traversal sequences in the JSON item header name field.…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 1,12 % · rekomendacja wg zapisanej polityki
The WP Dropzone plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 1.1.0 via the `ajax_upload_handle` function. This is due to the chunked upload functionality writing files directly to the uploads directory before any file type…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary shell commands.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker with specific permissions to hijack project runners from other projects.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An…
Opis źródłowy NVD · ENCVSS 8,6 · EPSS 1,61 % · rekomendacja wg zapisanej polityki
The ContentStudio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the cstu_update_post() function in all versions up to, and including, 1.3.7. This makes it possible for authenticated attackers, with Author-level access and above, to upload…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the remote JMX connector (RMI registry/server, enabled by default on ports 1099 and 44444). The guard is implemented as a…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,6 % · rekomendacja wg zapisanej polityki
FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel (UCP) are able to execute arbitrary commands on the PBX as the webserver user (typically asterisk) using specially crafted HTTP strings. Authenticated access to UCP is required. Note…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,6 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
md/raid5: avoid R5_Overlap races while breaking stripe batches
KCSAN report a race in break_stripe_batch_list() vs. raid5_make_request()
on sh->dev[i].flags (plain word write vs. atomic bit op)..
and .. one possible scenario…
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 0,6 % · rekomendacja wg zapisanej polityki
CVSS
8,8
EPSS
0,6 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending a crafted filename containing directory traversal sequences in the JSON item header name field.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 1,12 % · rekomendacja wg zapisanej polityki
The WP Dropzone plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 1.1.0 via the `ajax_upload_handle` function. This is due to the chunked upload functionality writing files directly to the uploads directory before any file type…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary shell commands.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker with specific permissions to hijack project runners from other projects.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,6 · EPSS 1,61 % · rekomendacja wg zapisanej polityki
The ContentStudio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the cstu_update_post() function in all versions up to, and including, 1.3.7. This makes it possible for authenticated attackers, with Author-level access and above, to upload…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the remote JMX connector (RMI registry/server, enabled by default on ports 1099 and 44444). The guard is implemented as a…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,6 % · rekomendacja wg zapisanej polityki
FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel (UCP) are able to execute arbitrary commands on the PBX as the webserver user (typically asterisk) using specially crafted HTTP strings. Authenticated access to UCP is required. Note…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,6 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
md/raid5: avoid R5_Overlap races while breaking stripe batches
KCSAN report a race in break_stripe_batch_list() vs. raid5_make_request()
on sh->dev[i].flags (plain word write vs. atomic bit op)..
and .. one possible scenario…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,8 · EPSS 0,6 % · rekomendacja wg zapisanej polityki
8,8
0,6 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.