Publikacje w kolejności czasu

Błąd w obsłudze zerowych rekordów w jądrze Linux może prowadzić do nieprawidłowego przetwarzania danych, co stwarza ryzyko wycieku informacji.

Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation.

Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code…

TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Niedostateczna autoryzacja w WhatsApp pozwala na przetwarzanie treści z dowolnego URL na urządzeniu ofiary.

Niewłaściwe filtrowanie danych w FreePBX umożliwia nieautoryzowany dostęp do administratora.

Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service.

Błąd zapisu poza granicami w systemach Apple może prowadzić do uszkodzenia pamięci.

N-able N-Central contains an insecure deserialization vulnerability that could lead to command execution.

N-able N-Central contains a command injection vulnerability via improper sanitization of user input.

Wrażliwość na przejście ścieżki w WinRAR na Windows umożliwia wykonanie dowolnego kodu.

Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.

Trend Micro Apex One Management Console (on-premise) contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.

Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application.

Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code.

Korupcja pamięci w Safari może prowadzić do zdalnego wykonania kodu przez przetwarzanie złośliwie przygotowanych treści internetowych.

Wyścig w obsłudze timerów CPU w jądrze Linuxa może prowadzić do nieprawidłowego zarządzania zadaniami.

Deserializacja niezaufanych danych w Microsoft SharePoint Server umożliwia zdalne wykonanie kodu.

Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.

W Livewire v3 do 3.6.3 występuje podatność umożliwiająca zdalne wykonanie kodu przez nieautoryzowanych atakujących.

Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an…

Niewystarczająca walidacja danych w Google Chrome umożliwia zdalne obejście piaskownicy.

Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default).