KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Wykorzystanie po zwolnieniu pamięci w Canvas w Google Chrome umożliwia zdalne wykonanie kodu.
Wykorzystanie po zwolnieniu pamięci w Google Chrome umożliwia zdalne wykonanie kodu.
Nieprawidłowe egzekwowanie polityki w OpenFGA umożliwia nieautoryzowany dostęp do zasobów.
Obejście uwierzytelnienia w serwerze HYPR umożliwia fałszowanie tożsamości.
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently…
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete A use-after-free issue occurs in mt76_rx_poll_complete due to a race condition. The STA has already been removed, but the rx_status still had a pointer to the wcid…
Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In sol_pdu_decrypt(), out is allocated as NET_BUF_SIMPLE(17) and then filled with…
Przechowywanie w postaci niezaszyfrowanej w Cisco Catalyst SD-WAN naraża dane wrażliwe.
Błąd w PraisonAI umożliwia fałszowanie zdarzeń webhooka przez nieautoryzowanych atakujących.
Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata…
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or…
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user…
Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when…
Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally.
Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
Nieprawidłowa autoryzacja w Tapo C200 umożliwia uzyskanie nieautoryzowanego dostępu administracyjnego.
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Wykorzystanie po zwolnieniu pamięci w Canvas w Google Chrome umożliwia zdalne wykonanie kodu. | Wykorzystanie po zwolnieniu pamięci w Canvas w Google Chrome umożliwia zdalne wykonanie kodu. |
Obserwuj | 8,8 | 0,31 % | ||
| Wykorzystanie po zwolnieniu pamięci w Google Chrome umożliwia zdalne wykonanie kodu. | Wykorzystanie po zwolnieniu pamięci w Google Chrome umożliwia zdalne wykonanie kodu. |
Obserwuj | 8,8 | 0,31 % | ||
| Nieprawidłowe egzekwowanie polityki w OpenFGA umożliwia nieautoryzowany dostęp do zasobów. | Nieprawidłowe egzekwowanie polityki w OpenFGA umożliwia nieautoryzowany dostęp do zasobów. |
Obserwuj | 8,8 | 0,31 % | ||
| Obejście uwierzytelnienia w serwerze HYPR umożliwia fałszowanie tożsamości. | Obejście uwierzytelnienia w serwerze HYPR umożliwia fałszowanie tożsamości. |
Obserwuj | 8,8 | 0,31 % | ||
| Nginx UI is a web user interface for the Nginx web server. | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently… |
Obserwuj | 8,8 | 0,31 % | ||
| In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete A… | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete A use-after-free issue occurs in mt76_rx_poll_complete due to a race condition. The STA has already been removed, but the rx_status still had a pointer to the wcid… |
Obserwuj | 8,8 | 0,31 % | ||
| Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the… | Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Obserwuj | 8,8 | 0,31 % | ||
| The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU… | The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In sol_pdu_decrypt(), out is allocated as NET_BUF_SIMPLE(17) and then filled with… |
Obserwuj | 8,8 | 0,31 % | ||
| Przechowywanie w postaci niezaszyfrowanej w Cisco Catalyst SD-WAN naraża dane wrażliwe. | Przechowywanie w postaci niezaszyfrowanej w Cisco Catalyst SD-WAN naraża dane wrażliwe. |
Obserwuj | 8,8 | 0,31 % | ||
| Błąd w PraisonAI umożliwia fałszowanie zdarzeń webhooka przez nieautoryzowanych atakujących. | Błąd w PraisonAI umożliwia fałszowanie zdarzeń webhooka przez nieautoryzowanych atakujących. |
Obserwuj | 8,8 | 0,31 % | ||
| Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to… | Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata… |
Obserwuj | 8,7 | 0,81 % | ||
| An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet… | An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or… |
Obserwuj | 8,8 | 0,31 % | ||
| Nginx UI is a web user interface for the Nginx web server. | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user… |
Obserwuj | 8,8 | 0,31 % | ||
| Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to… | Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Obserwuj | 8,8 | 0,31 % | ||
| Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated… | Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when… |
Obserwuj | 8,7 | 0,8 % | ||
| Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally. | Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally. |
Obserwuj | 8,8 | 0,3 % | ||
| Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. | Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. |
Obserwuj | 8,8 | 0,3 % | ||
| Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege… | Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1. |
Obserwuj | 8,8 | 0,3 % | ||
| Nieprawidłowa autoryzacja w Tapo C200 umożliwia uzyskanie nieautoryzowanego dostępu administracyjnego. | Nieprawidłowa autoryzacja w Tapo C200 umożliwia uzyskanie nieautoryzowanego dostępu administracyjnego. |
Obserwuj | 8,8 | 0,3 % | ||
| Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via… | Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Obserwuj | 8,8 | 0,3 % | ||
| Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside… | Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Obserwuj | 8,8 | 0,3 % | ||
| Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a… | Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Obserwuj | 8,8 | 0,3 % | ||
| Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a… | Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Obserwuj | 8,8 | 0,3 % | ||
| Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via… | Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Obserwuj | 8,8 | 0,3 % | ||
| Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via… | Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Obserwuj | 8,8 | 0,3 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.