Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
skb_zerocopy() copies frags from @from into @to. On an
skb_orphan_frags() failure it calls skb_tx_error(@from), a destructive
operation on the source skb the…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted.
An attacker can remove the signature from the XML document to make it pass the verification check.
XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
RansomLook does not consistently
enforce authorization checks when accessing groups, markets, and ransom
notes marked as private. An unauthenticated or otherwise unauthorized
remote attacker can access information associated with private entities
through several web views and API…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,66 % · rekomendacja wg zapisanej polityki
Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,65 % · rekomendacja wg zapisanej polityki
A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer causes privilege defined with unsafe actions. The attack…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,65 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
RISC-V: KVM: Synchronize hrtimer callback during teardown
The non-Sstc hrtimer callback clears next_set before its final uses of
the enclosing vCPU. If teardown observes next_set as false while the
callback is still running,…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,14 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
vdpa/mlx5: Fix buffer length in create_direct_keys()
We have seen in our CI the following KASAN message:
BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core]
Read of size 272 at addr 0000000176795020 by task…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,14 % · rekomendacja wg zapisanej polityki
Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 1,14 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
skb_zerocopy() copies frags from @from into @to. On an
skb_orphan_frags() failure it calls skb_tx_error(@from), a destructive
operation on the source skb the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted.
An attacker can remove the signature from the XML document to make it pass the verification check.
XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
RansomLook does not consistently
enforce authorization checks when accessing groups, markets, and ransom
notes marked as private. An unauthenticated or otherwise unauthorized
remote attacker can access information associated with private entities
through several web views and API…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,66 % · rekomendacja wg zapisanej polityki
Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,65 % · rekomendacja wg zapisanej polityki
A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer causes privilege defined with unsafe actions. The attack…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,65 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
RISC-V: KVM: Synchronize hrtimer callback during teardown
The non-Sstc hrtimer callback clears next_set before its final uses of
the enclosing vCPU. If teardown observes next_set as false while the
callback is still running,…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,14 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
vdpa/mlx5: Fix buffer length in create_direct_keys()
We have seen in our CI the following KASAN message:
BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core]
Read of size 272 at addr 0000000176795020 by task…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,14 % · rekomendacja wg zapisanej polityki
Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 1,14 % · rekomendacja wg zapisanej polityki