Publikacje w kolejności czasu

Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege.

Wykorzystanie podatności na traversję katalogów w interfejsie webowym Zyxel umożliwia pobieranie i przesyłanie plików.

Microsoft Partner Center contains an improper access control vulnerability that allows an attacker to escalate privileges.

Nieprawidłowe uwierzytelnienie w ProjectSend umożliwia zdalne modyfikacje konfiguracji aplikacji.

Wykonanie złośliwego kodu w Safari może prowadzić do zdalnego uruchomienia kodu.

Luka w zarządzaniu ciasteczkami w Safari umożliwia atak typu cross-site scripting.

Brak inicjalizacji bufora raportu w jądrze Linux umożliwia wyciek pamięci jądra.

Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure.

Eskalacja uprawnień w Palo Alto Networks PAN-OS umożliwia administratorowi dostęp do root.

Obejście uwierzytelnienia w PAN-OS pozwala nieautoryzowanemu atakującemu uzyskać uprawnienia administratora.

MDaemon Email Server contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to load arbitrary JavaScript code via an HTML e-mail message.

Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Android Framework contains an unspecified vulnerability that allows for privilege escalation.

Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain.

Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server.

Wykorzystanie luki w Harmonogramie zadań Windows umożliwia eskalację uprawnień.

Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user.

Obejście uwierzytelnienia w CyberPanel umożliwia zdalne wykonanie dowolnych poleceń.

Obejście uwierzytelnienia w CyberPanel pozwala na zdalne wykonanie dowolnych poleceń.

Nieograniczony upload i download plików w Cleo Harmony, VLTrader i LexiCom umożliwia zdalne wykonanie kodu.

Wyczerpanie zasobów w Cisco ASA umożliwia zdalnemu atakującemu wywołanie DoS usługi RAVPN.

Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.

Luka w NuPoint Unified Messaging umożliwia atak path traversal i nieautoryzowany dostęp do danych.

ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component.

Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the…