Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password.
This issue affects Apache Tomcat: from 11.0.0-M1 through…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,65 % · rekomendacja wg zapisanej polityki
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,55 % · rekomendacja wg zapisanej polityki
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.
This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,52 % · rekomendacja wg zapisanej polityki
Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files (when an agent tool invokes saveArtifact) outside the intended artifact…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may…
Opis źródłowy NVD · ENCVSS 9,2 · rekomendacja wg zapisanej polityki
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on…
Opis źródłowy NVD · ENCVSS 9,2 · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Workbench.…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an authenticated HTTP request to trigger this…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
CVSS
9,1
EPSS
0,4 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,79 % · rekomendacja wg zapisanej polityki
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,74 % · rekomendacja wg zapisanej polityki
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password.
This issue affects Apache Tomcat: from 11.0.0-M1 through…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,65 % · rekomendacja wg zapisanej polityki
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,61 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,55 % · rekomendacja wg zapisanej polityki
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.
This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,52 % · rekomendacja wg zapisanej polityki
Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files (when an agent tool invokes saveArtifact) outside the intended artifact…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,51 % · rekomendacja wg zapisanej polityki
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may…
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on…
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,44 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Workbench.…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,43 % · rekomendacja wg zapisanej polityki
A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an authenticated HTTP request to trigger this…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,4 % · rekomendacja wg zapisanej polityki
9,1
0,4 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.