KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout. The manipulation leads to session expiration. Remote exploitation of the attack is possible. The exploit is…
A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly…
W Pyenv przed 2.8.0 atakujący może przejąć kontrolę nad wyborem interpretera przez złośliwe pliki.
Błąd w Capstone umożliwia atakującym zdalne zablokowanie działania aplikacji.
Przesyłanie adresu e-mail w URL w Plane umożliwia ujawnienie danych osobowych.
A weakness has been identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/add_user.php of the component Password Handler. Executing a manipulation of the argument Password can lead to missing encryption of sensitive data. It is possible to…
Błąd w NocoDB pozwala na obejście ograniczeń uprawnień przez niewłaściwe zarządzanie tokenami OAuth.
This issue was addressed through improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access to a locked device may be able to bypass Digital ID authentication when iPhone Mirroring is active.
Błąd w fuse-overlayfs pozwala niskoprawnemu procesowi ustawić niebezpieczne uprawnienia pliku.
Improper access control for some Intel(R) PresentMon before version 2.3.1 within Ring 3: User Applications may allow a denial of service. Network adversary with a privileged user combined with a high complexity attack may enable denial of service. This result may potentially occur via adjacent…
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can…
Błąd w libvips umożliwia przepełnienie bufora, co może ujawniać dane lub powodować awarię.
Błąd użycia po zwolnieniu pamięci w sqlite3 pozwala na zdalne wykonanie kodu.
Błąd użycia po zwolnieniu pamięci w sqlite3 pozwala na niebezpieczne operacje w Ruby.
ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy when executing a magick script. Attackers can swap a checked path with a symlink during script execution to read files that the security policy is…
Sensitive information uncleared in resource before release for reuse for some Intel(R) NPU Drivers for Windows before version 32.0.100.4023 within Ring 3: User Applications may allow an information disclosure. Unprivileged software adversary with an authenticated user combined with a low…
answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolving symlinks. Attackers can ship a repository with a symlink pointing outside the checkout so am render embeds readable external…
Przechowywanie tokenów w czystym tekście w StrongDM umożliwia lokalny dostęp do danych uwierzytelniających.
Improper input validation in some firmware for some Intel(R) Graphics Drivers and Intel LTS kernels within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This…
A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub…
Przepełnienie bufora w SUSE Virtual Machine Driver Pack pozwala na modyfikację integralności sterownika.
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpected type when writing an image in a compressed format. An attacker who can cause such an image write can trigger a…
ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation. Attackers who can supply crafted -fx expressions under memory pressure can trigger freed memory access, causing crashes or memory…
ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application…
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. | A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout. The manipulation leads to session expiration. Remote exploitation of the attack is possible. The exploit is… |
Do wiadomości | 2,0 | 0,18 % | ||
| A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. | A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly… |
Do wiadomości | 2,0 | 0,18 % | ||
| W Pyenv przed 2.8.0 atakujący może przejąć kontrolę nad wyborem interpretera przez złośliwe pliki. | W Pyenv przed 2.8.0 atakujący może przejąć kontrolę nad wyborem interpretera przez złośliwe pliki. |
Do wiadomości | 2,0 | 0,17 % | ||
| Błąd w Capstone umożliwia atakującym zdalne zablokowanie działania aplikacji. | Błąd w Capstone umożliwia atakującym zdalne zablokowanie działania aplikacji. |
Do wiadomości | 2,0 | 0,17 % | ||
| Przesyłanie adresu e-mail w URL w Plane umożliwia ujawnienie danych osobowych. | Przesyłanie adresu e-mail w URL w Plane umożliwia ujawnienie danych osobowych. |
Do wiadomości | 2,0 | 0,17 % | ||
| A weakness has been identified in SourceCodester Drug Recommendation System 1.0. | A weakness has been identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/add_user.php of the component Password Handler. Executing a manipulation of the argument Password can lead to missing encryption of sensitive data. It is possible to… |
Do wiadomości | 2,0 | 0,15 % | ||
| Błąd w NocoDB pozwala na obejście ograniczeń uprawnień przez niewłaściwe zarządzanie tokenami OAuth. | Błąd w NocoDB pozwala na obejście ograniczeń uprawnień przez niewłaściwe zarządzanie tokenami OAuth. |
Do wiadomości | 2,0 | 0,15 % | ||
| This issue was addressed through improved state management. | This issue was addressed through improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access to a locked device may be able to bypass Digital ID authentication when iPhone Mirroring is active. |
Do wiadomości | 2,0 | 0,15 % | ||
| Błąd w fuse-overlayfs pozwala niskoprawnemu procesowi ustawić niebezpieczne uprawnienia pliku. | Błąd w fuse-overlayfs pozwala niskoprawnemu procesowi ustawić niebezpieczne uprawnienia pliku. |
Do wiadomości | 2,0 | 0,15 % | ||
| Improper access control for some Intel(R) PresentMon before version 2.3.1 within Ring 3: User Applications may allow a denial of service. | Improper access control for some Intel(R) PresentMon before version 2.3.1 within Ring 3: User Applications may allow a denial of service. Network adversary with a privileged user combined with a high complexity attack may enable denial of service. This result may potentially occur via adjacent… |
Do wiadomości | 2,0 | 0,14 % | ||
| virtualenv is a tool for creating isolated virtual python environments. | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can… |
Do wiadomości | 2,0 | 0,14 % | ||
| Błąd w libvips umożliwia przepełnienie bufora, co może ujawniać dane lub powodować awarię. | Błąd w libvips umożliwia przepełnienie bufora, co może ujawniać dane lub powodować awarię. |
Do wiadomości | 2,0 | 0,14 % | ||
| Błąd użycia po zwolnieniu pamięci w sqlite3 pozwala na zdalne wykonanie kodu. | Błąd użycia po zwolnieniu pamięci w sqlite3 pozwala na zdalne wykonanie kodu. |
Do wiadomości | 2,0 | 0,14 % | ||
| Błąd użycia po zwolnieniu pamięci w sqlite3 pozwala na niebezpieczne operacje w Ruby. | Błąd użycia po zwolnieniu pamięci w sqlite3 pozwala na niebezpieczne operacje w Ruby. |
Do wiadomości | 2,0 | 0,14 % | ||
| ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path… | ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy when executing a magick script. Attackers can swap a checked path with a symlink during script execution to read files that the security policy is… |
Do wiadomości | 2,0 | 0,14 % | ||
| Sensitive information uncleared in resource before release for reuse for some Intel(R) NPU Drivers for Windows before version… | Sensitive information uncleared in resource before release for reuse for some Intel(R) NPU Drivers for Windows before version 32.0.100.4023 within Ring 3: User Applications may allow an information disclosure. Unprivileged software adversary with an authenticated user combined with a low… |
Do wiadomości | 2,0 | 0,14 % | ||
| answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath()… | answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolving symlinks. Attackers can ship a repository with a symlink pointing outside the checkout so am render embeds readable external… |
Do wiadomości | 2,0 | 0,14 % | ||
| Przechowywanie tokenów w czystym tekście w StrongDM umożliwia lokalny dostęp do danych uwierzytelniających. | Przechowywanie tokenów w czystym tekście w StrongDM umożliwia lokalny dostęp do danych uwierzytelniających. |
Do wiadomości | 2,0 | 0,13 % | ||
| Improper input validation in some firmware for some Intel(R) Graphics Drivers and Intel LTS kernels within Ring 1: Device Drivers may… | Improper input validation in some firmware for some Intel(R) Graphics Drivers and Intel LTS kernels within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This… |
Do wiadomości | 2,0 | 0,13 % | ||
| A vulnerability was found in alexpasmantier television up to 0.15.9. | A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub… |
Do wiadomości | 1,9 | 0,62 % | ||
| Przepełnienie bufora w SUSE Virtual Machine Driver Pack pozwala na modyfikację integralności sterownika. | Przepełnienie bufora w SUSE Virtual Machine Driver Pack pozwala na modyfikację integralności sterownika. |
Do wiadomości | 2,0 | 0,12 % | ||
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal… | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpected type when writing an image in a compressed format. An attacker who can cause such an image write can trigger a… |
Do wiadomości | 2,0 | 0,11 % | ||
| ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails… | ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation. Attackers who can supply crafted -fx expressions under memory pressure can trigger freed memory access, causing crashes or memory… |
Do wiadomości | 2,0 | 0,11 % | ||
| ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of… | ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application… |
Do wiadomości | 2,0 | 0,11 % | ||
| ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security… | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to… |
Do wiadomości | 2,0 | 0,11 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.