KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Usunięcie parametru XSLT w Firefoxie prowadzi do wykorzystania błędu use-after-free.
An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1253, CVE-2019-1278, CVE-2019-1303.
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. To remediate…
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1320, CVE-2019-1340.
Wykorzystanie luki w Harmonogramie zadań Windows umożliwia eskalację uprawnień.
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of…
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0.
Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.
A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to…
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.
Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While…
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows…
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Lokalni użytkownicy mogą uzyskać uprawnienia w Exim przez złośliwą konfigurację.
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A malicious application may be able to execute arbitrary code with system privileges.
A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is…
The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0.
Błąd w weryfikacji bajtów w Adobe Flash Player umożliwia zdalne wykonanie kodu.
A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisco…
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1237, CVE-2020-1246, CVE-2020-1262, CVE-2020-1264, CVE-2020-1266, CVE-2020-1269,…
Niekompletny patch w N-central umożliwia obejście uwierzytelnienia i przejęcie konta.
Przepełnienie bufora w SNMP Cisco IOS pozwala zdalnie wykonać kod lub zrestartować system.
Nieokreślona podatność w Adobe Flash Player umożliwia zdalne wykonanie kodu przez złośliwe SWF.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Usunięcie parametru XSLT w Firefoxie prowadzi do wykorzystania błędu use-after-free. | Usunięcie parametru XSLT w Firefoxie prowadzi do wykorzystania błędu use-after-free. |
Pilne działanie | 8,8 | 14,26 % | ||
| An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of… | An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1253, CVE-2019-1278, CVE-2019-1303. |
Pilne działanie | 7,8 | 19,25 % | ||
| VMware Aria Operations contains a command injection vulnerability. | VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. To remediate… |
Pilne działanie | 8,1 | 17,71 % | ||
| An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation… | An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1320, CVE-2019-1340. |
Pilne działanie | 7,8 | 19,21 % | ||
| Wykorzystanie luki w Harmonogramie zadań Windows umożliwia eskalację uprawnień. | Wykorzystanie luki w Harmonogramie zadań Windows umożliwia eskalację uprawnień. |
Pilne działanie | 8,8 | 14,18 % | ||
| Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. | Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of… |
Pilne działanie | 7,8 | 19,11 % | ||
| The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. | The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0. |
Pilne działanie | 8,8 | 14,09 % | ||
| Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials. | Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials. |
Pilne działanie | 8,1 | 17,58 % | ||
| A type confusion issue was addressed with improved state handling. | A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to… |
Pilne działanie | 8,8 | 13,98 % | ||
| Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary… | Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter. |
Pilne działanie | 8,8 | 13,79 % | ||
| Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption… | Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Pilne działanie | 8,8 | 13,72 % | ||
| Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). | Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While… |
Pilne działanie | 8,8 | 13,4 % | ||
| An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows… | An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows… |
Pilne działanie | 7,8 | 18,39 % | ||
| A use after free issue was addressed with improved memory management. | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. |
Pilne działanie | 8,8 | 13,38 % | ||
| Lokalni użytkownicy mogą uzyskać uprawnienia w Exim przez złośliwą konfigurację. | Lokalni użytkownicy mogą uzyskać uprawnienia w Exim przez złośliwą konfigurację. |
Pilne działanie | 7,8 | 17,97 % | ||
| A use after free issue was addressed with improved memory management. | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A malicious application may be able to execute arbitrary code with system privileges. |
Pilne działanie | 7,8 | 17,61 % | ||
| A use-after-free issue was addressed with improved memory management. | A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is… |
Pilne działanie | 8,8 | 12,17 % | ||
| The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading… | The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0. |
Pilne działanie | 8,8 | 12,08 % | ||
| Błąd w weryfikacji bajtów w Adobe Flash Player umożliwia zdalne wykonanie kodu. | Błąd w weryfikacji bajtów w Adobe Flash Player umożliwia zdalne wykonanie kodu. |
Pilne działanie | 8,8 | 11,89 % | ||
| A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker… | A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisco… |
Pilne działanie | 8,8 | 11,68 % | ||
| Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
Pilne działanie | 7,8 | 16,67 % | ||
| An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel… | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1237, CVE-2020-1246, CVE-2020-1262, CVE-2020-1264, CVE-2020-1266, CVE-2020-1269,… |
Pilne działanie | 7,8 | 16,41 % | ||
| Niekompletny patch w N-central umożliwia obejście uwierzytelnienia i przejęcie konta. | Niekompletny patch w N-central umożliwia obejście uwierzytelnienia i przejęcie konta. |
Pilne działanie | 8,1 | 14,62 % | ||
| Przepełnienie bufora w SNMP Cisco IOS pozwala zdalnie wykonać kod lub zrestartować system. | Przepełnienie bufora w SNMP Cisco IOS pozwala zdalnie wykonać kod lub zrestartować system. |
Pilne działanie | 8,8 | 11,1 % | ||
| Nieokreślona podatność w Adobe Flash Player umożliwia zdalne wykonanie kodu przez złośliwe SWF. | Nieokreślona podatność w Adobe Flash Player umożliwia zdalne wykonanie kodu przez złośliwe SWF. |
Pilne działanie | 8,8 | 11,09 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.