KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Niedostateczna autoryzacja w WhatsApp pozwala na przetwarzanie treści z dowolnego URL na urządzeniu ofiary.
Win32k Elevation of Privilege Vulnerability
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its…
Wstrzyknięcie skryptów w Microsoft Exchange Server umożliwia oszustwa sieciowe.
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.
Błąd w Arm Trusted Firmware M umożliwia nieautoryzowane wywołanie funkcji zabezpieczających.
This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a…
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper…
Microsoft DWM Core Library Elevation of Privilege Vulnerability
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.
Obejście zabezpieczeń Mark of the Web w Windows umożliwia uruchomienie złośliwego kodu.
Błąd w jądrze Linuxa pozwalał na nieprzewidywalne przeplatanie danych przy równoczesnych zapisach w gnieździe af_alg.
Obejście zabezpieczeń Mark of the Web w Windows umożliwia uruchomienie złośliwego kodu.
An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6. A local user may be able to read kernel memory.
A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.
An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace.
Brak inicjalizacji bufora raportu w jądrze Linux umożliwia wyciek pamięci jądra.
<p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the…
Nieokreślona podatność w Oracle Application Server umożliwia zdalnym atakującym wpływ na integralność.
In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and…
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack…
Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic.
Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Niedostateczna autoryzacja w WhatsApp pozwala na przetwarzanie treści z dowolnego URL na urządzeniu ofiary. | Niedostateczna autoryzacja w WhatsApp pozwala na przetwarzanie treści z dowolnego URL na urządzeniu ofiary. |
Pilne działanie | 5,4 | 4,73 % | ||
| Win32k Elevation of Privilege Vulnerability | Win32k Elevation of Privilege Vulnerability |
Pilne działanie | 4,6 | 8,4 % | ||
| An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its… |
Pilne działanie | 5,4 | 4,06 % | ||
| Wstrzyknięcie skryptów w Microsoft Exchange Server umożliwia oszustwa sieciowe. | Wstrzyknięcie skryptów w Microsoft Exchange Server umożliwia oszustwa sieciowe. |
Pilne działanie | 6,1 | 0,52 % | ||
| An issue existed in the handling of environment variables. | An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information. |
Pilne działanie | 5,5 | 3,21 % | ||
| Błąd w Arm Trusted Firmware M umożliwia nieautoryzowane wywołanie funkcji zabezpieczających. | Błąd w Arm Trusted Firmware M umożliwia nieautoryzowane wywołanie funkcji zabezpieczających. |
Pilne działanie | 5,5 | 3,09 % | ||
| This issue was addressed with improved state management. | This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a… |
Pilne działanie | 5,5 | 2,9 % | ||
| Windows Common Log File System Driver Elevation of Privilege Vulnerability | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
Pilne działanie | 4,6 | 7,08 % | ||
| Windows Mark of the Web Security Feature Bypass Vulnerability | Windows Mark of the Web Security Feature Bypass Vulnerability |
Pilne działanie | 5,4 | 3,06 % | ||
| Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. | Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper… |
Pilne działanie | 5,3 | 3,45 % | ||
| Microsoft DWM Core Library Elevation of Privilege Vulnerability | Microsoft DWM Core Library Elevation of Privilege Vulnerability |
Pilne działanie | 4,6 | 6,56 % | ||
| Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
Pilne działanie | 5,5 | 2,02 % | ||
| Obejście zabezpieczeń Mark of the Web w Windows umożliwia uruchomienie złośliwego kodu. | Obejście zabezpieczeń Mark of the Web w Windows umożliwia uruchomienie złośliwego kodu. |
Pilne działanie | 5,4 | 2,49 % | ||
| Błąd w jądrze Linuxa pozwalał na nieprzewidywalne przeplatanie danych przy równoczesnych zapisach w gnieździe af_alg. | Błąd w jądrze Linuxa pozwalał na nieprzewidywalne przeplatanie danych przy równoczesnych zapisach w gnieździe af_alg. |
Pilne działanie | 5,5 | 1,36 % | ||
| Obejście zabezpieczeń Mark of the Web w Windows umożliwia uruchomienie złośliwego kodu. | Obejście zabezpieczeń Mark of the Web w Windows umożliwia uruchomienie złośliwego kodu. |
Pilne działanie | 5,4 | 1,81 % | ||
| An out-of-bounds read issue existed that led to the disclosure of kernel memory. | An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6. A local user may be able to read kernel memory. |
Pilne działanie | 5,5 | 1,13 % | ||
| A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory. | A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory. |
Pilne działanie | 5,5 | 1,1 % | ||
| An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace. | An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace. |
Pilne działanie | 5,5 | 1,08 % | ||
| Brak inicjalizacji bufora raportu w jądrze Linux umożliwia wyciek pamięci jądra. | Brak inicjalizacji bufora raportu w jądrze Linux umożliwia wyciek pamięci jądra. |
Pilne działanie | 5,5 | 0,81 % | ||
| <p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. | <p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the… |
Pilne działanie | 5,1 | 2,7 % | ||
| Nieokreślona podatność w Oracle Application Server umożliwia zdalnym atakującym wpływ na integralność. | Nieokreślona podatność w Oracle Application Server umożliwia zdalnym atakującym wpływ na integralność. |
Pilne działanie | 4,7 | 4,69 % | ||
| In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access… | In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and… |
Pilne działanie | 5,3 | 1,67 % | ||
| A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. | A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack… |
Pilne działanie | 5,5 | 0,67 % | ||
| Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format… | Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic. |
Pilne działanie | 5,5 | 0,53 % | ||
| Improper handling of address deregistration on failure can lead to new GPU address allocation failure. | Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables |
Pilne działanie | 5,5 | 0,52 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.