Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsd_server() in usr/src/cmd/zonestat/zonestatd/zonestatd.c, handles the…
Opis źródłowy NVD · ENCVSS 1,9 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c does not require the solaris.network.interface.config…
Opis źródłowy NVD · ENCVSS 1,9 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Impacted is the function UserDao.login of the file code/src/service/AdminDao.java. This manipulation of the argument Password causes cleartext storage of sensitive information. The attack is…
Opis źródłowy NVD · ENCVSS 1,9 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content.
Opis źródłowy NVD · ENCVSS 1,8 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths (e.g., content://zte.com.cn.filer.fileprovider/root_path), enabling file access with…
Opis źródłowy NVD · ENCVSS 1,8 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Anthropic Sandbox Runtime is a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container. Prior to 0.0.16, due to a bug in sandboxing logic, sandbox-runtime did not properly enforce a network sandbox if the…
Opis źródłowy NVD · ENCVSS 1,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Out-of-bounds write in the firmware for the Intel(R) Slim Bootloader may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are…
Opis źródłowy NVD · ENCVSS 1,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to…
Opis źródłowy NVD · ENalert CERT.pl · CVSS 1,8 · EPSS 0,14 % · rekomendacja wg zapisanej polityki
GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256. This leads to heap…
Opis źródłowy NVD · ENalert CERT.pl · CVSS 1,8 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing…
Opis źródłowy NVD · ENCVSS 1,8 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear…
Opis źródłowy NVD · ENCVSS 1,8 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsd_server() in usr/src/cmd/zonestat/zonestatd/zonestatd.c, handles the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 1,9 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c does not require the solaris.network.interface.config…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 1,9 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Impacted is the function UserDao.login of the file code/src/service/AdminDao.java. This manipulation of the argument Password causes cleartext storage of sensitive information. The attack is…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 1,9 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 1,8 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths (e.g., content://zte.com.cn.filer.fileprovider/root_path), enabling file access with…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 1,8 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Anthropic Sandbox Runtime is a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container. Prior to 0.0.16, due to a bug in sandboxing logic, sandbox-runtime did not properly enforce a network sandbox if the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 1,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Out-of-bounds write in the firmware for the Intel(R) Slim Bootloader may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 1,8 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to…
Opis źródłowy NVD · EN
Do wiadomości
alert CERT.pl · CVSS 1,8 · EPSS 0,14 % · rekomendacja wg zapisanej polityki
GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256. This leads to heap…
Opis źródłowy NVD · EN
Do wiadomości
alert CERT.pl · CVSS 1,8 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 1,8 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 1,8 · EPSS 0,12 % · rekomendacja wg zapisanej polityki