Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Improper access control for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclosure. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Server-side request forgery.
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized administrative privileges due to a race condition.
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does not…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that the final metadata block’s expected…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs,…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels(),…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
Improper access control for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclosure. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Server-side request forgery.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized administrative privileges due to a race condition.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does not…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that the final metadata block’s expected…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels(),…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,18 % · rekomendacja wg zapisanej polityki