KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Incomplete cleanup in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or…
Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an authenticated user who can register…
Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher (techdocs.publisher.type: 'local'), it was possible for the…
A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include…
Nieprawidłowe zwalnianie zasobów w IBM Db2 może prowadzić do odmowy usługi.
Nieprawidłowa alokacja zasobów w IBM Db2 może prowadzić do odmowy usługi przez uwierzytelnionego użytkownika.
Brak autoryzacji w Bux Woocommerce umożliwia dostęp do funkcji bez odpowiednich ograniczeń.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle…
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor.
Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise…
Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A ':matches' pattern was matched by a backtracking descent whose time grew with the…
A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity…
Błąd walidacji wejścia w IBM RSCT 3.0 umożliwia zdalnemu atakującemu wywołanie odmowy usługi.
Nieprawidłowa walidacja danych w RDK-B WebUI pozwala uwierzytelnionemu atakującemu na wywołanie odmowy usługi.
Dereferencja wskaźnika null w IBM AIX i PowerVM VIOS może prowadzić do odmowy usługi.
Luka w systemie aktywacji licencji pozwala zdalnym atakującym na ominięcie autoryzacji płatności.
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to…
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64…
Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
Incorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Incorrect authorization in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and…
An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a shared FortiGate device via crafted HTTP requests.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Incomplete cleanup in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass… | Incomplete cleanup in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low) |
Do wiadomości | 6,5 | 0,31 % | ||
| SFTPGo is an open source, event-driven file transfer solution. | SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or… |
Do wiadomości | 6,5 | 0,31 % | ||
| Backstage is an open framework for building developer portals. | Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an authenticated user who can register… |
Do wiadomości | 6,5 | 0,31 % | ||
| Backstage is an open framework for building developer portals. | Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher (techdocs.publisher.type: 'local'), it was possible for the… |
Do wiadomości | 6,5 | 0,31 % | ||
| A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through… | A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include… |
Do wiadomości | 6,5 | 0,31 % | ||
| Nieprawidłowe zwalnianie zasobów w IBM Db2 może prowadzić do odmowy usługi. | Nieprawidłowe zwalnianie zasobów w IBM Db2 może prowadzić do odmowy usługi. |
Do wiadomości | 6,5 | 0,31 % | ||
| Nieprawidłowa alokacja zasobów w IBM Db2 może prowadzić do odmowy usługi przez uwierzytelnionego użytkownika. | Nieprawidłowa alokacja zasobów w IBM Db2 może prowadzić do odmowy usługi przez uwierzytelnionego użytkownika. |
Do wiadomości | 6,5 | 0,31 % | ||
| Brak autoryzacji w Bux Woocommerce umożliwia dostęp do funkcji bez odpowiednich ograniczeń. | Brak autoryzacji w Bux Woocommerce umożliwia dostęp do funkcji bez odpowiednich ograniczeń. |
Do wiadomości | 6,5 | 0,31 % | ||
| Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle… |
Do wiadomości | 6,5 | 0,31 % | ||
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure… | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor. |
Do wiadomości | 6,5 | 0,31 % | ||
| Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. | Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise… |
Do wiadomości | 6,5 | 0,31 % | ||
| Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated… | Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A ':matches' pattern was matched by a backtracking descent whose time grew with the… |
Do wiadomości | 6,5 | 0,31 % | ||
| A flaw was found in Maestro. | A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity… |
Do wiadomości | 6,5 | 0,31 % | ||
| Błąd walidacji wejścia w IBM RSCT 3.0 umożliwia zdalnemu atakującemu wywołanie odmowy usługi. | Błąd walidacji wejścia w IBM RSCT 3.0 umożliwia zdalnemu atakującemu wywołanie odmowy usługi. |
Do wiadomości | 6,5 | 0,31 % | ||
| Nieprawidłowa walidacja danych w RDK-B WebUI pozwala uwierzytelnionemu atakującemu na wywołanie odmowy usługi. | Nieprawidłowa walidacja danych w RDK-B WebUI pozwala uwierzytelnionemu atakującemu na wywołanie odmowy usługi. |
Do wiadomości | 6,5 | 0,31 % | ||
| Dereferencja wskaźnika null w IBM AIX i PowerVM VIOS może prowadzić do odmowy usługi. | Dereferencja wskaźnika null w IBM AIX i PowerVM VIOS może prowadzić do odmowy usługi. |
Do wiadomości | 6,5 | 0,31 % | ||
| Luka w systemie aktywacji licencji pozwala zdalnym atakującym na ominięcie autoryzacji płatności. | Luka w systemie aktywacji licencji pozwala zdalnym atakującym na ominięcie autoryzacji płatności. |
Do wiadomości | 6,5 | 0,31 % | ||
| Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to… |
Do wiadomości | 6,5 | 0,31 % | ||
| Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64… |
Do wiadomości | 6,5 | 0,31 % | ||
| Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak sensitive information… | Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Do wiadomości | 6,5 | 0,31 % | ||
| Incorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a… | Incorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Do wiadomości | 6,5 | 0,31 % | ||
| Incorrect authorization in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a… | Incorrect authorization in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Do wiadomości | 6,5 | 0,31 % | ||
| Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a… | Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Do wiadomości | 6,5 | 0,31 % | ||
| The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public… | The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and… |
Do wiadomości | 6,5 | 0,31 % | ||
| An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a… | An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a shared FortiGate device via crafted HTTP requests. |
Do wiadomości | 6,5 | 0,31 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.