KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Memory corruption in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Memory corruption in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Use after free in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Memory corruption in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser,…
Błąd w jądrze Linuxa w module ath11k prowadzi do awarii przy przetwarzaniu fragmentów od niezsynchronizowanego peer.
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user…
Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.
Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7.
Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1.
Przepełnienie bufora w jądrze Linuxa w sensor_hub_get_feature umożliwia zdalne wykonanie kodu.
Wstrzyknięcie danych w pg_dump w PostgreSQL pozwala na wykonanie złośliwego kodu przez superużytkownika.
The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation…
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00_status_entry() filters out non-TYPE_SRB entries and the SRB_NVME_CMD, SRB_BIDI_CMD and SRB_TM_CMD types, then falls through to a SCSI fast path that assumes the…
Błąd w jądrze Linuxa pozwalał na pozostawienie nieusuniętych grup sysfs po niepowodzeniu, co mogło prowadzić do nieprawidłowego dostępu do pamięci.
In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so->rx_lock The TX state machine (so->tx.state) is driven from three contexts: sendmsg() claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and…
In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcm_rx_setup() when updating timer and filter content while bcm_rx_handler(),…
Podwójne zwolnienie pamięci w jądrze Linux w SMB2_open może prowadzić do awarii systemu.
Przepełnienie bufora w jądrze Linuxa umożliwia zdalne wywołanie paniki systemu.
Przepełnienie w mnożeniu w jądrze Linuxa może prowadzić do błędnych obliczeń w kryptografii ECC.
Błąd w jądrze Linux w Bluetooth L2CAP może prowadzić do awarii systemu.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside… | Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Obserwuj | 8,8 | 0,36 % | ||
| Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code… | Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Obserwuj | 8,8 | 0,36 % | ||
| Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the… | Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Obserwuj | 8,8 | 0,36 % | ||
| Memory corruption in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute… | Memory corruption in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Obserwuj | 8,8 | 0,36 % | ||
| Memory corruption in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code… | Memory corruption in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Obserwuj | 8,8 | 0,36 % | ||
| Use after free in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code… | Use after free in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Obserwuj | 8,8 | 0,36 % | ||
| Memory corruption in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code… | Memory corruption in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Obserwuj | 8,8 | 0,36 % | ||
| Nginx UI is a web user interface for the Nginx web server. | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser,… |
W tym tygodniu | 8,8 | 0,36 % | ||
| Błąd w jądrze Linuxa w module ath11k prowadzi do awarii przy przetwarzaniu fragmentów od niezsynchronizowanego peer. | Błąd w jądrze Linuxa w module ath11k prowadzi do awarii przy przetwarzaniu fragmentów od niezsynchronizowanego peer. |
Obserwuj | 8,8 | 0,36 % | ||
| Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of… | Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user… |
Obserwuj | 8,7 | 0,86 % | ||
| Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue… | Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12. |
Obserwuj | 8,8 | 0,36 % | ||
| Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This… | Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7. |
Obserwuj | 8,8 | 0,36 % | ||
| Deserialization of Untrusted Data vulnerability in Vektor Inc. | Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1. |
Obserwuj | 8,8 | 0,36 % | ||
| Przepełnienie bufora w jądrze Linuxa w sensor_hub_get_feature umożliwia zdalne wykonanie kodu. | Przepełnienie bufora w jądrze Linuxa w sensor_hub_get_feature umożliwia zdalne wykonanie kodu. |
Obserwuj | 8,8 | 0,36 % | ||
| Wstrzyknięcie danych w pg_dump w PostgreSQL pozwala na wykonanie złośliwego kodu przez superużytkownika. | Wstrzyknięcie danych w pg_dump w PostgreSQL pozwala na wykonanie złośliwego kodu przez superużytkownika. |
Obserwuj | 8,8 | 0,36 % | ||
| The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. | The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it. |
Obserwuj | 8,8 | 0,35 % | ||
| Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation… |
Obserwuj | 8,8 | 0,35 % | ||
| In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast… | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00_status_entry() filters out non-TYPE_SRB entries and the SRB_NVME_CMD, SRB_BIDI_CMD and SRB_TM_CMD types, then falls through to a SCSI fast path that assumes the… |
Obserwuj | 8,8 | 0,35 % | ||
| Błąd w jądrze Linuxa pozwalał na pozostawienie nieusuniętych grup sysfs po niepowodzeniu, co mogło prowadzić do nieprawidłowego dostępu do… | Błąd w jądrze Linuxa pozwalał na pozostawienie nieusuniętych grup sysfs po niepowodzeniu, co mogło prowadzić do nieprawidłowego dostępu do pamięci. |
Obserwuj | 8,8 | 0,35 % | ||
| In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so->rx_lock The TX… | In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so->rx_lock The TX state machine (so->tx.state) is driven from three contexts: sendmsg() claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and… |
Obserwuj | 8,8 | 0,35 % | ||
| In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN… | In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcm_rx_setup() when updating timer and filter content while bcm_rx_handler(),… |
Obserwuj | 8,8 | 0,35 % | ||
| Podwójne zwolnienie pamięci w jądrze Linux w SMB2_open może prowadzić do awarii systemu. | Podwójne zwolnienie pamięci w jądrze Linux w SMB2_open może prowadzić do awarii systemu. |
Obserwuj | 8,8 | 0,35 % | ||
| Przepełnienie bufora w jądrze Linuxa umożliwia zdalne wywołanie paniki systemu. | Przepełnienie bufora w jądrze Linuxa umożliwia zdalne wywołanie paniki systemu. |
Obserwuj | 8,8 | 0,35 % | ||
| Przepełnienie w mnożeniu w jądrze Linuxa może prowadzić do błędnych obliczeń w kryptografii ECC. | Przepełnienie w mnożeniu w jądrze Linuxa może prowadzić do błędnych obliczeń w kryptografii ECC. |
Obserwuj | 8,8 | 0,35 % | ||
| Błąd w jądrze Linux w Bluetooth L2CAP może prowadzić do awarii systemu. | Błąd w jądrze Linux w Bluetooth L2CAP może prowadzić do awarii systemu. |
Obserwuj | 8,8 | 0,35 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.