KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Błąd w pnpm pozwala na instalację złośliwych pakietów mimo niezgodności integralności.
Wykorzystanie przejścia ścieżki w add-ons.org umożliwia dostęp do nieautoryzowanych plików.
Wstrzyknięcie poleceń w D-Link DWR-M921 umożliwia zdalne wykonanie kodu.
Wrażliwość na odczyt adresu w module komunikacyjnym może wpłynąć na dostępność.
Out-of-bounds write vulnerability in Citrix Workspace app for Windows. This issue affects Workspace app for Windows: before 2603.20 CR, before LTSR 2607 Hotfix 1, and before LTSR 2507 CU3 Hotfix 1.
The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which…
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec by passing a null current-tab pointer to RunWithExe(), which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or…
Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files. To mitigate this issue, users should upgrade to version 4.10.0 or later.
An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processing certificate management operations, user-supplied certificate identifiers are handled without adequate sanitization prior to execution in…
A Cross-Site Request Forgery (CSRF) vulnerability was identified in HCL Glovius Cloud. An attacker can force a user's web browser to execute an unwanted, malicious action on a trusted site where the user is authenticated, specifically on one endpoint.
Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML document with deeply nested elements. The…
Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the…
Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter (dcmdata/libdcxml/xml2dcm.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML…
Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOM JSON…
An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized certificates,…
In wacom_hid_set_device_mode of wacom_sys.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Nieprawidłowe ograniczenia bufora w sterownikach Display Virtualization dla Windows mogą prowadzić do odmowy usługi.
Błąd use after free w sterowniku Intel Ethernet 800 może prowadzić do odmowy usługi.
Improper handling of overlap between protected memory ranges in some microcode for some Intel(R) Processors within Ring 0: Hypervisor may allow an escalation of privilege. Authorized adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This…
This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.
Awaria mechanizmu ochrony w Windows BitLocker umożliwia atakującemu ominięcie zabezpieczeń.
FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default…
DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which…
Ujawnienie wrażliwych informacji w procesorach Intel umożliwia atakującym dostęp do danych.
The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Błąd w pnpm pozwala na instalację złośliwych pakietów mimo niezgodności integralności. | Błąd w pnpm pozwala na instalację złośliwych pakietów mimo niezgodności integralności. |
Do wiadomości | 6,8 | 0,11 % | ||
| Wykorzystanie przejścia ścieżki w add-ons.org umożliwia dostęp do nieautoryzowanych plików. | Wykorzystanie przejścia ścieżki w add-ons.org umożliwia dostęp do nieautoryzowanych plików. |
Do wiadomości | 6,8 | 0,11 % | ||
| Wstrzyknięcie poleceń w D-Link DWR-M921 umożliwia zdalne wykonanie kodu. | Wstrzyknięcie poleceń w D-Link DWR-M921 umożliwia zdalne wykonanie kodu. |
Do wiadomości | 6,3 | 2,61 % | ||
| Wrażliwość na odczyt adresu w module komunikacyjnym może wpłynąć na dostępność. | Wrażliwość na odczyt adresu w module komunikacyjnym może wpłynąć na dostępność. |
Do wiadomości | 6,8 | 0,11 % | ||
| Out-of-bounds write vulnerability in Citrix Workspace app for Windows. | Out-of-bounds write vulnerability in Citrix Workspace app for Windows. This issue affects Workspace app for Windows: before 2603.20 CR, before LTSR 2607 Hotfix 1, and before LTSR 2507 CU3 Hotfix 1. |
Do wiadomości | 6,8 | 0,11 % | ||
| The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. | The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which… |
Do wiadomości | 6,8 | 0,11 % | ||
| SumatraPDF is a multi-format reader for Windows. | SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec by passing a null current-tab pointer to RunWithExe(), which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or… |
Do wiadomości | 6,8 | 0,11 % | ||
| Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain… | Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files. To mitigate this issue, users should upgrade to version 4.10.0 or later. |
Do wiadomości | 6,8 | 0,11 % | ||
| An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative… | An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processing certificate management operations, user-supplied certificate identifiers are handled without adequate sanitization prior to execution in… |
Do wiadomości | 6,8 | 0,11 % | ||
| A Cross-Site Request Forgery (CSRF) vulnerability was identified in HCL Glovius Cloud. | A Cross-Site Request Forgery (CSRF) vulnerability was identified in HCL Glovius Cloud. An attacker can force a user's web browser to execute an unwanted, malicious action on a trusted site where the user is authenticated, specifically on one endpoint. |
Do wiadomości | 6,8 | 0,11 % | ||
| Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of… | Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML document with deeply nested elements. The… |
Do wiadomości | 6,8 | 0,11 % | ||
| Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a… | Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the… |
Do wiadomości | 6,8 | 0,11 % | ||
| Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM… | Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter (dcmdata/libdcxml/xml2dcm.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML… |
Do wiadomości | 6,8 | 0,11 % | ||
| Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in… | Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOM JSON… |
Do wiadomości | 6,8 | 0,11 % | ||
| An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. | An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized certificates,… |
Do wiadomości | 6,8 | 0,1 % | ||
| In wacom_hid_set_device_mode of wacom_sys.c, there is a possible out-of-bounds write due to a missing bounds check. | In wacom_hid_set_device_mode of wacom_sys.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Do wiadomości | 6,8 | 0,1 % | ||
| Nieprawidłowe ograniczenia bufora w sterownikach Display Virtualization dla Windows mogą prowadzić do odmowy usługi. | Nieprawidłowe ograniczenia bufora w sterownikach Display Virtualization dla Windows mogą prowadzić do odmowy usługi. |
Do wiadomości | 6,8 | 0,1 % | ||
| Błąd use after free w sterowniku Intel Ethernet 800 może prowadzić do odmowy usługi. | Błąd use after free w sterowniku Intel Ethernet 800 może prowadzić do odmowy usługi. |
Do wiadomości | 6,8 | 0,1 % | ||
| Improper handling of overlap between protected memory ranges in some microcode for some Intel(R) Processors within Ring 0: Hypervisor may… | Improper handling of overlap between protected memory ranges in some microcode for some Intel(R) Processors within Ring 0: Hypervisor may allow an escalation of privilege. Authorized adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This… |
Do wiadomości | 6,8 | 0,1 % | ||
| This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system. | This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system. |
Do wiadomości | 6,8 | 0,1 % | ||
| Awaria mechanizmu ochrony w Windows BitLocker umożliwia atakującemu ominięcie zabezpieczeń. | Awaria mechanizmu ochrony w Windows BitLocker umożliwia atakującemu ominięcie zabezpieczeń. |
Do wiadomości | 6,8 | 0,1 % | ||
| FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys… | FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default… |
Do wiadomości | 6,8 | 0,1 % | ||
| DriveLock Directory Traversal Information Disclosure Vulnerability. | DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which… |
Do wiadomości | 6,5 | 1,6 % | ||
| Ujawnienie wrażliwych informacji w procesorach Intel umożliwia atakującym dostęp do danych. | Ujawnienie wrażliwych informacji w procesorach Intel umożliwia atakującym dostęp do danych. |
Do wiadomości | 6,8 | 0,1 % | ||
| The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. | The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in… |
Do wiadomości | 6,8 | 0,09 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.