KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege Vulnerability'.
Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution.
Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate…
Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with…
JFrog Artifactory może ujawniać token anonimowego użytkownika nieautoryzowanemu wywołującemu, co naraża zasoby.
The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution.
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0.
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate…
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data.…
Podrabianie w instalatorze AppX w Windows umożliwia ataki phishingowe z złośliwymi załącznikami.
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Deserializacja nieufnych danych w Microsoft Office SharePoint pozwala na zdalne wykonanie kodu.
A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue management for Internet Group Management…
An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0686.
Przepełnienie bufora w oprogramowaniu Zyxel GS1900-48HPv2 umożliwia zdalne wykonanie poleceń.
Nieokreślona podatność w serwerze Commvault umożliwia zdalne przejęcie kontroli przez uwierzytelnionego atakującego.
Błąd odczytu i zapisu poza zakresem w V8 w Google Chrome umożliwia zdalne wykonanie kodu.
Błąd zapisu poza granicami w Skia w Google Chrome umożliwia zdalnemu atakującemu dostęp do pamięci.
Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it consume available memory and eventually…
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5. Processing a maliciously crafted mail message may lead to unexpected memory modification or application termination.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka… | An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege Vulnerability'. |
Pilne działanie | 7,8 | 8,59 % | ||
| Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. | Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. |
Pilne działanie | 8,1 | 7,06 % | ||
| An integer overflow was addressed with improved input validation. | An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. |
Pilne działanie | 8,8 | 3,52 % | ||
| Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1. | Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1. |
Pilne działanie | 8,8 | 3,45 % | ||
| VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. | VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate… |
Pilne działanie | 7,8 | 8,44 % | ||
| Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE… | Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with… |
Pilne działanie | 8,8 | 3,35 % | ||
| JFrog Artifactory może ujawniać token anonimowego użytkownika nieautoryzowanemu wywołującemu, co naraża zasoby. | JFrog Artifactory może ujawniać token anonimowego użytkownika nieautoryzowanemu wywołującemu, co naraża zasoby. |
Pilne działanie | 7,5 | 9,81 % | ||
| The issue was addressed with improved bounds checks. | The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution. |
Pilne działanie | 8,8 | 3,21 % | ||
| Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP,… | Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface. |
Pilne działanie | 8,8 | 3,19 % | ||
| Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox… | Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Pilne działanie | 8,8 | 3,14 % | ||
| A buffer overflow issue was addressed with improved memory handling. | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.. |
Pilne działanie | 8,8 | 3 % | ||
| . The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root… | . The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0. |
Pilne działanie | 8,8 | 2,99 % | ||
| A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the… | A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate… |
Pilne działanie | 7,8 | 7,88 % | ||
| A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote… | A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data.… |
Pilne działanie | 7,5 | 9,36 % | ||
| Podrabianie w instalatorze AppX w Windows umożliwia ataki phishingowe z złośliwymi załącznikami. | Podrabianie w instalatorze AppX w Windows umożliwia ataki phishingowe z złośliwymi załącznikami. |
Pilne działanie | 7,1 | 11,29 % | ||
| Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap… | Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Pilne działanie | 8,8 | 2,76 % | ||
| Deserializacja nieufnych danych w Microsoft Office SharePoint pozwala na zdalne wykonanie kodu. | Deserializacja nieufnych danych w Microsoft Office SharePoint pozwala na zdalne wykonanie kodu. |
Pilne działanie | 8,8 | 2,7 % | ||
| A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated,… | A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue management for Internet Group Management… |
Pilne działanie | 8,6 | 3,7 % | ||
| An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer… | An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0686. |
Pilne działanie | 7,8 | 7,61 % | ||
| Przepełnienie bufora w oprogramowaniu Zyxel GS1900-48HPv2 umożliwia zdalne wykonanie poleceń. | Przepełnienie bufora w oprogramowaniu Zyxel GS1900-48HPv2 umożliwia zdalne wykonanie poleceń. |
Pilne działanie | 8,8 | 2,5 % | ||
| Nieokreślona podatność w serwerze Commvault umożliwia zdalne przejęcie kontroli przez uwierzytelnionego atakującego. | Nieokreślona podatność w serwerze Commvault umożliwia zdalne przejęcie kontroli przez uwierzytelnionego atakującego. |
Pilne działanie | 8,8 | 2,48 % | ||
| Błąd odczytu i zapisu poza zakresem w V8 w Google Chrome umożliwia zdalne wykonanie kodu. | Błąd odczytu i zapisu poza zakresem w V8 w Google Chrome umożliwia zdalne wykonanie kodu. |
Pilne działanie | 8,8 | 2,44 % | ||
| Błąd zapisu poza granicami w Skia w Google Chrome umożliwia zdalnemu atakującemu dostęp do pamięci. | Błąd zapisu poza granicami w Skia w Google Chrome umożliwia zdalnemu atakującemu dostęp do pamięci. |
Pilne działanie | 8,8 | 2,34 % | ||
| Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an… | Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it consume available memory and eventually… |
Pilne działanie | 8,6 | 3,32 % | ||
| An out-of-bounds write issue was addressed with improved bounds checking. | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5. Processing a maliciously crafted mail message may lead to unexpected memory modification or application termination. |
Pilne działanie | 8,8 | 2,29 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.