Baza CVE

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause execution of Linux Operating system commands when a system back up is restored that has been maliciously modified.

Lokalna podatność w Winlogbeat umożliwia atakującemu z niskimi uprawnieniami usunięcie lub zapisanie plików.

A security issue exists within FactoryTalk® Historian Machine Edition. An attacker with low-level authentication could exploit this vulnerability to achieve remote code execution on the affected device.

CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause denial of service of the OPC UA communication platform when a large number of OPC UA requests are sent to the platform.

A denial-of-service security issue exists in the affected product. The security issue stems from a crafted CIP packet being sent crashing the module. The device requires a restart to recover.

Błędy w Thunderbird mogą prowadzić do uszkodzenia pamięci i potencjalnych exploitów.

Błędy w Thunderbird mogą prowadzić do uszkodzenia pamięci i potencjalnych exploitów.

Ujawnienie informacji w komponencie WebGPU w Firefoxie może prowadzić do wycieku danych.

Eskalacja uprawnień z powodu nieprawidłowego wskaźnika w komponencie graficznym.

Ujawnienie informacji w komponencie Networking: HTTP w Firefox umożliwia dostęp do wrażliwych danych.

Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

Eskalacja uprawnień w komponencie WebDriver BiDi umożliwia nieautoryzowany dostęp.

Eskalacja uprawnień w Firefox na Androida umożliwia nieautoryzowany dostęp.

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to write attacker-controlled content to arbitrary filesystem paths.

Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attacker could potentially exploit this vulnerability to escalate privileges to Administrator.

A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web server. This can result in a loss of web server availability

Wstrzyknięcie poleceń w LibreNMS umożliwia zdalne wykonanie kodu przez uwierzytelnionego administratora.

Automatyczne dołączanie tokena ServiceAccount w Kyverno umożliwia atakującym jego eksfiltrację.

Wykorzystanie podatności SSRF w Kyverno pozwala uwierzytelnionym użytkownikom na wysyłanie dowolnych żądań HTTP.

AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated attackers to mark arbitrary scheduled broadcasts as failed by sending crafted POST requests with schedule identifiers. Attackers can exploit the unguarded RTMP callback endpoint to…

LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shell_exec() without proper validation. An authenticated administrator can modify the snmpget configuration to point to a malicious executable…

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog…

Błąd autoryzacji w Dell PowerStore pozwala na eskalację uprawnień przez uwierzytelnionego atakującego.

AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos,…

A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an authenticated user with basic permissions to execute commands on virtual machines belonging to other users via the `one.vm.exec`…