Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,69 % · rekomendacja wg zapisanej polityki
NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ...…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,69 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
vhost/net: complete zerocopy ubufs only once
vhost-net initializes one ubuf_info per outstanding zerocopy TX
descriptor and hands it to the backend socket. The networking stack may
then clone a zerocopy skb before all skb…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
When the service of ABP and AES is installed in a directory writable by non-administrative users, an attacker can replace or plant a DLL with the same name as one loaded by the service. Upon service restart, the malicious DLL is loaded and executed under the LocalSystem account, resulting in…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Fix race between LPI release and re-registration
Fix a potential race between decrementing an LPI's reference count and
evicting that structure from the LPI xarray.
LPI structures are maintained in the VGIC…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,69 % · rekomendacja wg zapisanej polityki
RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private.
The /export/<database> endpoint permits selected internal databases to be exported without requiring…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,69 % · rekomendacja wg zapisanej polityki
CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing (requires 3 preprocessing rounds), identifiable abort, and a key refresh protocol. Prior to version 0.6.3, there is a missing check in the ZK proof that enables an attack in which single malicious signer can reconstruct…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
KVM services local TLB flushes on "full" nested VM-Exits (through
__nested_vmx_vmexit()), but not if a nested VM-Enter fails (e.g. due to
failed VMCS checks in…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling
Hyunwoo Kim reports some really bad races should the following
situation occur:
- LPI-I is pending in vcpu-B's AP list
- vcpu-A writes to…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Check the interrupt is still ours before migrating it
vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating
an interrupt to another vCPU. After reacquiring the locks it only checks
that the…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new settings since there is no session token or authentication in place. This would allow an attacker for instance to point the device to an…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,69 % · rekomendacja wg zapisanej polityki
NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ...…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,69 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
vhost/net: complete zerocopy ubufs only once
vhost-net initializes one ubuf_info per outstanding zerocopy TX
descriptor and hands it to the backend socket. The networking stack may
then clone a zerocopy skb before all skb…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
When the service of ABP and AES is installed in a directory writable by non-administrative users, an attacker can replace or plant a DLL with the same name as one loaded by the service. Upon service restart, the malicious DLL is loaded and executed under the LocalSystem account, resulting in…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Fix race between LPI release and re-registration
Fix a potential race between decrementing an LPI's reference count and
evicting that structure from the LPI xarray.
LPI structures are maintained in the VGIC…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,69 % · rekomendacja wg zapisanej polityki
RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private.
The /export/<database> endpoint permits selected internal databases to be exported without requiring…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,69 % · rekomendacja wg zapisanej polityki
CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing (requires 3 preprocessing rounds), identifiable abort, and a key refresh protocol. Prior to version 0.6.3, there is a missing check in the ZK proof that enables an attack in which single malicious signer can reconstruct…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
KVM services local TLB flushes on "full" nested VM-Exits (through
__nested_vmx_vmexit()), but not if a nested VM-Enter fails (e.g. due to
failed VMCS checks in…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling
Hyunwoo Kim reports some really bad races should the following
situation occur:
- LPI-I is pending in vcpu-B's AP list
- vcpu-A writes to…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Check the interrupt is still ours before migrating it
vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating
an interrupt to another vCPU. After reacquiring the locks it only checks
that the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new settings since there is no session token or authentication in place. This would allow an attacker for instance to point the device to an…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki