Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
In the Linux kernel, the following vulnerability has been resolved:
s390/mm: Fix handling of _PAGE_UNUSED pte bit
The _PAGE_UNUSED softbit should not really be lying around. Its sole
purpose is to signal to try_to_unmap_one() and try_to_migrate_one()
that the page can be discarded instead of…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Fix unlikely race in try_get_locked_pte()
Fix an unlikely race in try_get_locked_pte(), which could have happened
if puds or pmds get unmapped between the p?dp_get() and p?d_offset()
functions.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN"
Revert
99cf1fb58e68 ("x86/virt/sev: Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN").
Section 8.8 of the SNP spec says:
Before invoking…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
scsiback_get_pend_req() obtains a command tag and returns a vscsibk_pend
whose embedded se_cmd has only been memset to 0, so its cmd_kref is 0;
the…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined.…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context. To remediate this issue, users should upgrade to version 11.3.1 or later.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
skb_zerocopy() copies frags from @from into @to. On an
skb_orphan_frags() failure it calls skb_tx_error(@from), a destructive
operation on the source skb the…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted.
An attacker can remove the signature from the XML document to make it pass the verification check.
XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
RansomLook does not consistently
enforce authorization checks when accessing groups, markets, and ransom
notes marked as private. An unauthenticated or otherwise unauthorized
remote attacker can access information associated with private entities
through several web views and API…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,66 % · rekomendacja wg zapisanej polityki
Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,65 % · rekomendacja wg zapisanej polityki
A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer causes privilege defined with unsafe actions. The attack…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
CVSS
9,3
EPSS
0,15 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
In the Linux kernel, the following vulnerability has been resolved:
s390/mm: Fix handling of _PAGE_UNUSED pte bit
The _PAGE_UNUSED softbit should not really be lying around. Its sole
purpose is to signal to try_to_unmap_one() and try_to_migrate_one()
that the page can be discarded instead of…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Fix unlikely race in try_get_locked_pte()
Fix an unlikely race in try_get_locked_pte(), which could have happened
if puds or pmds get unmapped between the p?dp_get() and p?d_offset()
functions.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN"
Revert
99cf1fb58e68 ("x86/virt/sev: Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN").
Section 8.8 of the SNP spec says:
Before invoking…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
scsiback_get_pend_req() obtains a command tag and returns a vscsibk_pend
whose embedded se_cmd has only been memset to 0, so its cmd_kref is 0;
the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined.…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context. To remediate this issue, users should upgrade to version 11.3.1 or later.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
skb_zerocopy() copies frags from @from into @to. On an
skb_orphan_frags() failure it calls skb_tx_error(@from), a destructive
operation on the source skb the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted.
An attacker can remove the signature from the XML document to make it pass the verification check.
XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
RansomLook does not consistently
enforce authorization checks when accessing groups, markets, and ransom
notes marked as private. An unauthenticated or otherwise unauthorized
remote attacker can access information associated with private entities
through several web views and API…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,66 % · rekomendacja wg zapisanej polityki
Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,65 % · rekomendacja wg zapisanej polityki
A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer causes privilege defined with unsafe actions. The attack…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
9,3
0,15 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.