KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Wstrzyknięcie SQL w Drupal core umożliwia atakującym wykonanie nieautoryzowanych zapytań.
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted…
Luka w rozszerzeniu Balbooa Forms umożliwia nieautoryzowane przesyłanie plików i zdalne wykonanie kodu.
goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_user<*1*>administrator<*1*>123456 request.
Przechodzenie katalogów w ONLYOFFICE Document Server umożliwia zdalne wykonanie kodu.
Wykonanie zdalnego kodu przed uwierzytelnieniem w N-central zagraża bezpieczeństwu systemu.
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized…
Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges. The vulnerability is due to incorrect bounds…
Słabość uwierzytelniania w JFrog Artifactory umożliwia zdobycie uprawnień administratora.
Obejście uwierzytelnienia wskaźników w systemach Apple umożliwia atakującemu zdalne manipulowanie danymi.
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.
Przepełnienie bufora w DHCP relay w Cisco IOS pozwala na zdalne wykonanie kodu lub DoS.
Microsoft Exchange Server Elevation of Privilege Vulnerability
Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability.
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3, macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may…
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.
Błąd w WordPress umożliwia SQL Injection i zdalne wykonanie kodu.
Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.
Luka w PeopleSoft Enterprise PeopleTools umożliwia przejęcie systemu przez nieautoryzowanego atakującego.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Wstrzyknięcie SQL w Drupal core umożliwia atakującym wykonanie nieautoryzowanych zapytań. | Wstrzyknięcie SQL w Drupal core umożliwia atakującym wykonanie nieautoryzowanych zapytań. |
Pilne działanie | 9,8 | 15,7 % | ||
| Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to… | Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High) |
Pilne działanie | 9,6 | 16,47 % | ||
| A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. | A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted… |
Pilne działanie | 10,0 | 14,03 % | ||
| Luka w rozszerzeniu Balbooa Forms umożliwia nieautoryzowane przesyłanie plików i zdalne wykonanie kodu. | Luka w rozszerzeniu Balbooa Forms umożliwia nieautoryzowane przesyłanie plików i zdalne wykonanie kodu. |
Pilne działanie | 9,8 | 14,85 % | ||
| goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges… | goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_user<*1*>administrator<*1*>123456 request. |
Pilne działanie | 9,8 | 14,67 % | ||
| Przechodzenie katalogów w ONLYOFFICE Document Server umożliwia zdalne wykonanie kodu. | Przechodzenie katalogów w ONLYOFFICE Document Server umożliwia zdalne wykonanie kodu. |
Pilne działanie | 9,8 | 14,55 % | ||
| Wykonanie zdalnego kodu przed uwierzytelnieniem w N-central zagraża bezpieczeństwu systemu. | Wykonanie zdalnego kodu przed uwierzytelnieniem w N-central zagraża bezpieczeństwu systemu. |
Pilne działanie | 9,8 | 14,51 % | ||
| This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. | This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions. |
Pilne działanie | 9,8 | 14,37 % | ||
| Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. | Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized… |
Pilne działanie | 10,0 | 13,35 % | ||
| Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a… | Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
Pilne działanie | 9,6 | 15,24 % | ||
| A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated,… | A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges. The vulnerability is due to incorrect bounds… |
Pilne działanie | 9,8 | 14,2 % | ||
| Słabość uwierzytelniania w JFrog Artifactory umożliwia zdobycie uprawnień administratora. | Słabość uwierzytelniania w JFrog Artifactory umożliwia zdobycie uprawnień administratora. |
Pilne działanie | 9,8 | 14,12 % | ||
| Obejście uwierzytelnienia wskaźników w systemach Apple umożliwia atakującemu zdalne manipulowanie danymi. | Obejście uwierzytelnienia wskaźników w systemach Apple umożliwia atakującemu zdalne manipulowanie danymi. |
Pilne działanie | 9,8 | 13,97 % | ||
| VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection… | VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability. |
Pilne działanie | 9,1 | 17,3 % | ||
| Przepełnienie bufora w DHCP relay w Cisco IOS pozwala na zdalne wykonanie kodu lub DoS. | Przepełnienie bufora w DHCP relay w Cisco IOS pozwala na zdalne wykonanie kodu lub DoS. |
Pilne działanie | 9,8 | 13,77 % | ||
| Microsoft Exchange Server Elevation of Privilege Vulnerability | Microsoft Exchange Server Elevation of Privilege Vulnerability |
Pilne działanie | 9,8 | 12,56 % | ||
| Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary… | Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability. |
Pilne działanie | 9,8 | 11,86 % | ||
| A memory corruption issue was addressed with improved input validation. | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3, macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may… |
Pilne działanie | 9,8 | 11,64 % | ||
| Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. | Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later. |
Pilne działanie | 9,8 | 11,41 % | ||
| Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to… | Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. |
Pilne działanie | 9,6 | 11,74 % | ||
| Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for… | Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x. |
Pilne działanie | 9,8 | 10,67 % | ||
| Błąd w WordPress umożliwia SQL Injection i zdalne wykonanie kodu. | Błąd w WordPress umożliwia SQL Injection i zdalne wykonanie kodu. |
Pilne działanie | 9,8 | 10,65 % | ||
| Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway… | Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server |
Pilne działanie | 9,8 | 10,56 % | ||
| Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. | Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. |
Pilne działanie | 9,8 | 10,07 % | ||
| Luka w PeopleSoft Enterprise PeopleTools umożliwia przejęcie systemu przez nieautoryzowanego atakującego. | Luka w PeopleSoft Enterprise PeopleTools umożliwia przejęcie systemu przez nieautoryzowanego atakującego. |
Pilne działanie | 9,8 | 9,44 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.