Średnia
CVE-2023-46136
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 6 861
Wyczyść filtry
Wysoka
CVE-2023-46128
Nautobot vulnerable to exposure of hashed user passwords via REST API
Średnia
CVE-2023-46288
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0.
Średnia
CVE-2023-46331
WebAssembly wabt 1.0.33 has an Out-of-Bound Memory Read in in DataSegment::IsValidRange(), which lead to segmentation fault.
Średnia
CVE-2023-46332
WebAssembly wabt 1.0.33 contains an Out-of-Bound Memory Write in DataSegment::Drop(), which lead to segmentation fault.
Średnia
CVE-2021-46898
views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //examp
Średnia
CVE-2021-46897
views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media.
Krytyczna
CVE-2023-32785
Langchain SQL Injection vulnerability
Wysoka
CVE-2023-5690
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2.
Średnia
CVE-2023-5688
Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.
Średnia
CVE-2023-5689
Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.
Średnia
CVE-2023-41893
Home Assistant vulnerable to account takeover via auth_callback login
Średnia
CVE-2023-44690
mycli has Inadequate Encryption Strength
Wysoka
CVE-2023-45815
Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins context
Niska
CVE-2023-45809
Wagtail vulnerable to disclosure of user names via admin bulk action views
Wysoka
CVE-2023-46229
LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.
Średnia
CVE-2023-45803
urllib3's request body not stripped after redirect from 303 status changes request method to GET
Wysoka
CVE-2023-5590
NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.0.
Średnia
CVE-2018-25091
urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in t
Średnia
CVE-2023-42792
Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write acce
Średnia
CVE-2023-42663
Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs.
Średnia
CVE-2023-42780
Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAG
Średnia
CVE-2023-45348
Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the "expose_config" option is set to "no
Średnia
CVE-2023-28635
Defining resource name as integer may give unintended access in vantage6
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.