CVE Veritabanı
Teknik veriler otomatik gelir, önemli açıklıklar Türkçeye çevrilir. Editörlerimizin incelediği kayıtlar İncelendi etiketiyle işaretlenir.
NVD, CISA KEV ve EPSS kaynaklarından otomatik senkronize edilir
1.000+ sonuç · sayfa 24
Rejected reason: Further research determined the issue is not a vulnerability.
3 gün önce
CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There…
3 gün önce · EPSS %0.1
Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate.…
3 gün önce · EPSS %0.2
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the HMAC key, and nothing…
3 gün önce · EPSS %0.1
Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A webhook body with a top-level "payload" key is…
3 gün önce · EPSS %0.2
CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig() returns the caller's whole cbuser row, including the…
3 gün önce · EPSS %0.2
CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator() is documented to anchor the supplied pattern at both ends, but…
3 gün önce · EPSS %0.3
CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the login name to the application log without escaping control characters. The login…
3 gün önce · EPSS %0.2
CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before_dispatch hook installed by…
3 gün önce · EPSS %0.2
CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. restoreConfigBlob() feeds the database dump in a backup to the…
3 gün önce · EPSS %0.2
CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key. getCrypt() pads the backup password with "x" characters and cuts it to 32 bytes to…
3 gün önce · EPSS %0.1
CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob() has the sqlite3 shell write the dump…
3 gün önce · EPSS %0.2
CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route. Every CallBackery application mounts its documentation plugin…
3 gün önce · EPSS %0.2
HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so…
3 gün önce · EPSS %0.3
Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies. The decoder adds each read to one buffer of unconsumed input.…
3 gün önce · EPSS %0.2
Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection. The request method is not passed to the…
3 gün önce · EPSS %0.2
Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits,…
3 gün önce · EPSS %0.2
Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the…
3 gün önce · EPSS %0.2
FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /api/guest/staff/login) that allows remote attackers to force authentication…
3 gün önce
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with…
3 gün önce · EPSS %0.3
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Insufficiently Protected Credentials vulnerability. A low privileged attacker with remote access could potentially exploit this…
3 gün önce · EPSS %0.2
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with adjacent network access…
3 gün önce · EPSS %0.2
SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause.…
3 gün önce · EPSS %0.1
SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim.…
3 gün önce · EPSS %0.8
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session…
3 gün önce · EPSS %0.4
vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in…
3 gün önce · EPSS %0.2
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host.…
3 gün önce · EPSS %0.2
Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a…
3 gün önce · EPSS %0.3
Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the…
3 gün önce · EPSS %0.3
phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display().…
3 gün önce · EPSS %0.2