KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Wykonanie kodu zdalnego w Array Networks AG Series umożliwia przeglądanie systemu plików bez uwierzytelnienia.
Luka w SimpleHelp umożliwia technikom niskich uprawnień tworzenie kluczy API z nadmiernymi uprawnieniami.
Przepełnienie całkowite w Adobe Reader i Acrobat umożliwia zdalne wykonanie kodu.
Słaba autoryzacja w Microsoft Office SharePoint pozwala na obejście zabezpieczeń przez nieuprawnionego atakującego.
An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme…
Korupcja pamięci w Microsoft PowerPoint umożliwia zdalne wykonanie kodu.
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.
D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730,…
Wykorzystanie exec_globals w Langflow umożliwia zdalne wykonanie dowolnego kodu.
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3,…
Obejście uwierzytelnienia w Juniper ScreenOS umożliwia zdalny dostęp administracyjny.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer…
Błąd w politykach grupowych w Windows umożliwia zdalnym użytkownikom uzyskanie poufnych haseł.
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is…
AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap.…
Wykorzystanie podatności na traversję katalogów w Arcserve UDP umożliwia zdalne uzyskanie wrażliwych danych.
Luka w dynamicznym ładowaniu klas w PaperCut umożliwia wykonanie dowolnego kodu Java.
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.
NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing…
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Wykonanie kodu zdalnego w Array Networks AG Series umożliwia przeglądanie systemu plików bez uwierzytelnienia. | Wykonanie kodu zdalnego w Array Networks AG Series umożliwia przeglądanie systemu plików bez uwierzytelnienia. |
Pilne działanie | 9,8 | 68,08 % | ||
| Luka w SimpleHelp umożliwia technikom niskich uprawnień tworzenie kluczy API z nadmiernymi uprawnieniami. | Luka w SimpleHelp umożliwia technikom niskich uprawnień tworzenie kluczy API z nadmiernymi uprawnieniami. |
Pilne działanie | 9,9 | 66,6 % | ||
| Przepełnienie całkowite w Adobe Reader i Acrobat umożliwia zdalne wykonanie kodu. | Przepełnienie całkowite w Adobe Reader i Acrobat umożliwia zdalne wykonanie kodu. |
Pilne działanie | 9,8 | 66,55 % | ||
| Słaba autoryzacja w Microsoft Office SharePoint pozwala na obejście zabezpieczeń przez nieuprawnionego atakującego. | Słaba autoryzacja w Microsoft Office SharePoint pozwala na obejście zabezpieczeń przez nieuprawnionego atakującego. |
Pilne działanie | 9,1 | 69,54 % | ||
| An issue was discovered in Veritas Backup Exec before 21.2. | An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme… |
Pilne działanie | 9,8 | 64,91 % | ||
| Korupcja pamięci w Microsoft PowerPoint umożliwia zdalne wykonanie kodu. | Korupcja pamięci w Microsoft PowerPoint umożliwia zdalne wykonanie kodu. |
Pilne działanie | 9,3 | 67,31 % | ||
| SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL… | SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives. |
Pilne działanie | 9,8 | 64,73 % | ||
| D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the… | D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022. |
Pilne działanie | 9,8 | 64,24 % | ||
| Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix… | Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730,… |
Pilne działanie | 9,8 | 63,63 % | ||
| Wykorzystanie exec_globals w Langflow umożliwia zdalne wykonanie dowolnego kodu. | Wykorzystanie exec_globals w Langflow umożliwia zdalne wykonanie dowolnego kodu. |
Pilne działanie | 9,8 | 63,01 % | ||
| Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption… | Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Pilne działanie | 9,6 | 63,89 % | ||
| Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of… | Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution. |
Pilne działanie | 9,8 | 61,99 % | ||
| A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13,… | A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3,… |
Pilne działanie | 9,8 | 61,72 % | ||
| Obejście uwierzytelnienia w Juniper ScreenOS umożliwia zdalny dostęp administracyjny. | Obejście uwierzytelnienia w Juniper ScreenOS umożliwia zdalny dostęp administracyjny. |
Pilne działanie | 9,8 | 61,14 % | ||
| On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before… | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer… |
Pilne działanie | 9,8 | 61,06 % | ||
| Błąd w politykach grupowych w Windows umożliwia zdalnym użytkownikom uzyskanie poufnych haseł. | Błąd w politykach grupowych w Windows umożliwia zdalnym użytkownikom uzyskanie poufnych haseł. |
Pilne działanie | 9,0 | 64,88 % | ||
| A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. | A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is… |
Pilne działanie | 9,8 | 60,81 % | ||
| AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A… | AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability. |
Pilne działanie | 9,8 | 60,75 % | ||
| GeoServer is an open source server that allows users to share and edit geospatial data. | GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap.… |
Pilne działanie | 9,8 | 60,52 % | ||
| Wykorzystanie podatności na traversję katalogów w Arcserve UDP umożliwia zdalne uzyskanie wrażliwych danych. | Wykorzystanie podatności na traversję katalogów w Arcserve UDP umożliwia zdalne uzyskanie wrażliwych danych. |
Pilne działanie | 9,1 | 63,64 % | ||
| Luka w dynamicznym ładowaniu klas w PaperCut umożliwia wykonanie dowolnego kodu Java. | Luka w dynamicznym ładowaniu klas w PaperCut umożliwia wykonanie dowolnego kodu Java. |
Pilne działanie | 9,1 | 63,53 % | ||
| IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the… | IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533. |
Pilne działanie | 9,1 | 61,69 % | ||
| NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level. | NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level. |
Pilne działanie | 9,8 | 57,47 % | ||
| Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the… | Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing… |
Pilne działanie | 10,0 | 55,87 % | ||
| Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. | Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later. |
Pilne działanie | 9,8 | 56,69 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.