KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
Nieprawidłowe neutralizowanie elementów w IBM i umożliwia zdalnemu atakującemu wykonanie poleceń z podwyższonymi uprawnieniami.
Nieprawidłowa walidacja pola komendy w IBM Langflow umożliwia zdalne wykonanie dowolnych poleceń.
Błąd w RHOAI umożliwia eskalację uprawnień w Kubernetes przez tworzenie zadań treningowych.
Wykonanie dowolnych poleceń w Electerm umożliwia złośliwy serwer SSH lub SFTP.
Wykonanie zdalnego kodu w FuelCMS umożliwia atakującemu z autoryzacją przejęcie kontroli.
Wstrzyknięcie kodu w happy-dom umożliwia zdalne wykonanie kodu przez nieprawidłowe przetwarzanie modułów.
Wykorzystanie luki w NLTK pozwala na zdalne wykonanie kodu przez złośliwe archiwa ZIP.
Wykonanie zdalnego kodu w Packetfence 13.2.0 przez ustawienia interfejsu WebGui.
A vulnerability was identified in Ningyuanda TC155 57.0.2.0. This impacts an unknown function of the file /onvif/device_service of the component ONVIF PTZ Control Interface. The manipulation leads to improper access controls. The attack requires being on the local network. The exploit is publicly…
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco_save_settings() function, which…
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter
ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on the system, overwriting binaries and allowing code execution. The upload function takes `file.name` directly from user supplied data without…
GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do…
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function. The vulnerability is caused by insufficient filtering before the filename field is concatenated into a command. A remote attacker can trigger this vulnerability via crafted input to execute…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of… | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. |
Obserwuj | 8,8 | 0,79 % | ||
| Nieprawidłowe neutralizowanie elementów w IBM i umożliwia zdalnemu atakującemu wykonanie poleceń z podwyższonymi uprawnieniami. | Nieprawidłowe neutralizowanie elementów w IBM i umożliwia zdalnemu atakującemu wykonanie poleceń z podwyższonymi uprawnieniami. |
Obserwuj | 8,8 | 0,79 % | ||
| Nieprawidłowa walidacja pola komendy w IBM Langflow umożliwia zdalne wykonanie dowolnych poleceń. | Nieprawidłowa walidacja pola komendy w IBM Langflow umożliwia zdalne wykonanie dowolnych poleceń. |
Obserwuj | 8,8 | 0,79 % | ||
| Błąd w RHOAI umożliwia eskalację uprawnień w Kubernetes przez tworzenie zadań treningowych. | Błąd w RHOAI umożliwia eskalację uprawnień w Kubernetes przez tworzenie zadań treningowych. |
Obserwuj | 8,8 | 0,79 % | ||
| Wykonanie dowolnych poleceń w Electerm umożliwia złośliwy serwer SSH lub SFTP. | Wykonanie dowolnych poleceń w Electerm umożliwia złośliwy serwer SSH lub SFTP. |
Obserwuj | 8,8 | 0,79 % | ||
| Wykonanie zdalnego kodu w FuelCMS umożliwia atakującemu z autoryzacją przejęcie kontroli. | Wykonanie zdalnego kodu w FuelCMS umożliwia atakującemu z autoryzacją przejęcie kontroli. |
W tym tygodniu | 8,8 | 0,79 % | ||
| Wstrzyknięcie kodu w happy-dom umożliwia zdalne wykonanie kodu przez nieprawidłowe przetwarzanie modułów. | Wstrzyknięcie kodu w happy-dom umożliwia zdalne wykonanie kodu przez nieprawidłowe przetwarzanie modułów. |
W tym tygodniu | 8,8 | 0,79 % | ||
| Wykorzystanie luki w NLTK pozwala na zdalne wykonanie kodu przez złośliwe archiwa ZIP. | Wykorzystanie luki w NLTK pozwala na zdalne wykonanie kodu przez złośliwe archiwa ZIP. |
W tym tygodniu | 8,8 | 0,79 % | ||
| Wykonanie zdalnego kodu w Packetfence 13.2.0 przez ustawienia interfejsu WebGui. | Wykonanie zdalnego kodu w Packetfence 13.2.0 przez ustawienia interfejsu WebGui. |
Obserwuj | 8,8 | 0,79 % | ||
| A vulnerability was identified in Ningyuanda TC155 57.0.2.0. | A vulnerability was identified in Ningyuanda TC155 57.0.2.0. This impacts an unknown function of the file /onvif/device_service of the component ONVIF PTZ Control Interface. The manipulation leads to improper access controls. The attack requires being on the local network. The exploit is publicly… |
W tym tygodniu | 8,8 | 0,79 % | ||
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,8 | 0,79 % | ||
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,8 | 0,79 % | ||
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,8 | 0,79 % | ||
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,8 | 0,79 % | ||
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,8 | 0,79 % | ||
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,8 | 0,79 % | ||
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,8 | 0,79 % | ||
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,8 | 0,79 % | ||
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,8 | 0,79 % | ||
| Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. |
Obserwuj | 8,8 | 0,79 % | ||
| The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is vulnerable to Arbitrary… | The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco_save_settings() function, which… |
Obserwuj | 8,8 | 0,79 % | ||
| An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). | An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter |
Obserwuj | 8,8 | 0,78 % | ||
| ConvertXis a self-hosted online file converter. | ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on the system, overwriting binaries and allowing code execution. The upload function takes `file.name` directly from user supplied data without… |
W tym tygodniu | 8,8 | 0,78 % | ||
| GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting… | GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do… |
Obserwuj | 8,7 | 1,28 % | ||
| Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function. | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function. The vulnerability is caused by insufficient filtering before the filename field is concatenated into a command. A remote attacker can trigger this vulnerability via crafted input to execute… |
Obserwuj | 8,6 | 1,78 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.