KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Luka w Windows UPnP umożliwia eskalację uprawnień przez nieprawidłowe tworzenie obiektów COM.
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized PowerShell commands.
Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Podatność na podwójne zwolnienie w Adobe Flash Player umożliwia zdalne wykonanie kodu.
Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Interfejs WAP w Trihedral VTScada umożliwia zdalnym atakującym wywołanie awarii aplikacji.
Luka w językach skryptowych Windows umożliwia zdalne wykonanie kodu.
Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
Przepełnienie bufora w FreeType umożliwia zdalne wykonanie kodu.
A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0970.
Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this…
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to…
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1, watchOS 7.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been…
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Błąd w jądrze Windows umożliwia lokalnym użytkownikom eskalację uprawnień przez 16-bitowe aplikacje.
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Podatność w sterowniku Windows Common Log File System umożliwia eskalację uprawnień.
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN…
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from…
Luka use-after-free w komponencie nf_tables jądra Linux umożliwia eskalację uprawnień lokalnych.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Luka w Windows UPnP umożliwia eskalację uprawnień przez nieprawidłowe tworzenie obiektów COM. | Luka w Windows UPnP umożliwia eskalację uprawnień przez nieprawidłowe tworzenie obiektów COM. |
Pilne działanie | 7,8 | 30,17 % | ||
| Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. | Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior. |
Pilne działanie | 8,6 | 25,98 % | ||
| Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode… | Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized PowerShell commands. |
Pilne działanie | 8,4 | 26,94 % | ||
| Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption… | Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Pilne działanie | 8,8 | 24,93 % | ||
| Podatność na podwójne zwolnienie w Adobe Flash Player umożliwia zdalne wykonanie kodu. | Podatność na podwójne zwolnienie w Adobe Flash Player umożliwia zdalne wykonanie kodu. |
Pilne działanie | 8,8 | 24,82 % | ||
| Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted… | Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Pilne działanie | 8,8 | 24,73 % | ||
| Interfejs WAP w Trihedral VTScada umożliwia zdalnym atakującym wywołanie awarii aplikacji. | Interfejs WAP w Trihedral VTScada umożliwia zdalnym atakującym wywołanie awarii aplikacji. |
Pilne działanie | 7,5 | 31,17 % | ||
| Luka w językach skryptowych Windows umożliwia zdalne wykonanie kodu. | Luka w językach skryptowych Windows umożliwia zdalne wykonanie kodu. |
Pilne działanie | 8,8 | 24,62 % | ||
| Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. | Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. |
Pilne działanie | 8,8 | 24,54 % | ||
| The issue was addressed with improved checks. | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7. |
Pilne działanie | 8,8 | 24,35 % | ||
| Przepełnienie bufora w FreeType umożliwia zdalne wykonanie kodu. | Przepełnienie bufora w FreeType umożliwia zdalne wykonanie kodu. |
Pilne działanie | 8,1 | 27,78 % | ||
| A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code… | A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface. |
Pilne działanie | 7,2 | 32,25 % | ||
| A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka… | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0970. |
Pilne działanie | 7,5 | 30,68 % | ||
| Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted… | Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Pilne działanie | 8,8 | 24,03 % | ||
| A type confusion issue was addressed with improved checks. | A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this… |
Pilne działanie | 8,8 | 23,97 % | ||
| An issue was discovered in Veritas Backup Exec before 21.2. | An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to… |
Pilne działanie | 8,8 | 23,95 % | ||
| A memory corruption issue was addressed with improved memory handling. | A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1, watchOS 7.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been… |
Pilne działanie | 7,8 | 28,84 % | ||
| Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
Pilne działanie | 7,8 | 28,74 % | ||
| Błąd w jądrze Windows umożliwia lokalnym użytkownikom eskalację uprawnień przez 16-bitowe aplikacje. | Błąd w jądrze Windows umożliwia lokalnym użytkownikom eskalację uprawnień przez 16-bitowe aplikacje. |
Pilne działanie | 7,8 | 28,74 % | ||
| Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks. | Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks. |
Pilne działanie | 7,5 | 30,04 % | ||
| Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a… | Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
Pilne działanie | 8,8 | 23,51 % | ||
| Podatność w sterowniku Windows Common Log File System umożliwia eskalację uprawnień. | Podatność w sterowniku Windows Common Log File System umożliwia eskalację uprawnień. |
Pilne działanie | 7,8 | 28,28 % | ||
| A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the… | A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN… |
Pilne działanie | 8,4 | 25,15 % | ||
| A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka… | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from… |
Pilne działanie | 7,5 | 29,61 % | ||
| Luka use-after-free w komponencie nf_tables jądra Linux umożliwia eskalację uprawnień lokalnych. | Luka use-after-free w komponencie nf_tables jądra Linux umożliwia eskalację uprawnień lokalnych. |
Pilne działanie | 7,8 | 28,06 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.