KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Luka w Palo Alto Networks WildFire umożliwia odczyt wrażliwych danych i usuwanie plików.
Niebezpieczna deserializacja w bibliotece snorkel umożliwia zdalne wykonanie kodu.
Niebezpieczna deserializacja w bibliotece snorkel umożliwia zdalne wykonanie kodu.
Brak autoryzacji w wtyczce Jupiter X Core pozwala na niebezpieczne przesyłanie plików przez uwierzytelnionych atakujących.
Błąd w jądrze Linux w Bluetooth 6lowpan umożliwia awarię systemu przy odbiorze pakietów IPv6.
A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same…
Błąd w jądrze Linuxa prowadzi do awarii przy dereferencji nieprawidłowego wskaźnika błędu.
Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
Eskalacja uprawnień w komponencie Workers w DOM umożliwia nieautoryzowany dostęp.
Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non-empty string as valid. Unauthenticated attackers can submit forged APS delegation payloads with arbitrary scopes to bypass signature…
Słaba polityka haseł w Lynx+ Gateway umożliwia nieautoryzowany dostęp przez atak brute-force.
The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is…
The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key has…
The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector…
The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute…
As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases…
Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder…
In the Linux kernel, the following vulnerability has been resolved: net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add While doing smcr_port_add, there maybe linkgroup add into or delete from smc_lgr_list.list at the same time, which may result kernel crash. So,…
Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow a low-privilege user to elevate privileges within the application. This issue affects Flipper: 3.1.2.
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Luka w Palo Alto Networks WildFire umożliwia odczyt wrażliwych danych i usuwanie plików. | Luka w Palo Alto Networks WildFire umożliwia odczyt wrażliwych danych i usuwanie plików. |
Obserwuj | 8,8 | 0,28 % | ||
| Niebezpieczna deserializacja w bibliotece snorkel umożliwia zdalne wykonanie kodu. | Niebezpieczna deserializacja w bibliotece snorkel umożliwia zdalne wykonanie kodu. |
Obserwuj | 8,8 | 0,28 % | ||
| Niebezpieczna deserializacja w bibliotece snorkel umożliwia zdalne wykonanie kodu. | Niebezpieczna deserializacja w bibliotece snorkel umożliwia zdalne wykonanie kodu. |
Obserwuj | 8,8 | 0,28 % | ||
| Brak autoryzacji w wtyczce Jupiter X Core pozwala na niebezpieczne przesyłanie plików przez uwierzytelnionych atakujących. | Brak autoryzacji w wtyczce Jupiter X Core pozwala na niebezpieczne przesyłanie plików przez uwierzytelnionych atakujących. |
Obserwuj | 8,8 | 0,28 % | ||
| Błąd w jądrze Linux w Bluetooth 6lowpan umożliwia awarię systemu przy odbiorze pakietów IPv6. | Błąd w jądrze Linux w Bluetooth 6lowpan umożliwia awarię systemu przy odbiorze pakietów IPv6. |
Obserwuj | 8,8 | 0,28 % | ||
| A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own… | A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same… |
Obserwuj | 8,8 | 0,28 % | ||
| Błąd w jądrze Linuxa prowadzi do awarii przy dereferencji nieprawidłowego wskaźnika błędu. | Błąd w jądrze Linuxa prowadzi do awarii przy dereferencji nieprawidłowego wskaźnika błędu. |
Obserwuj | 8,8 | 0,28 % | ||
| Privilege escalation in the DOM: Content Processes component. | Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
Obserwuj | 8,8 | 0,28 % | ||
| Eskalacja uprawnień w komponencie Workers w DOM umożliwia nieautoryzowany dostęp. | Eskalacja uprawnień w komponencie Workers w DOM umożliwia nieautoryzowany dostęp. |
Obserwuj | 8,8 | 0,28 % | ||
| Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local… | Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non-empty string as valid. Unauthenticated attackers can submit forged APS delegation payloads with arbitrary scopes to bypass signature… |
Obserwuj | 8,8 | 0,28 % | ||
| Słaba polityka haseł w Lynx+ Gateway umożliwia nieautoryzowany dostęp przez atak brute-force. | Słaba polityka haseł w Lynx+ Gateway umożliwia nieautoryzowany dostęp przez atak brute-force. |
Obserwuj | 8,8 | 0,28 % | ||
| The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits… | The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is… |
Obserwuj | 8,8 | 0,28 % | ||
| The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation… | The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key has… |
Obserwuj | 8,8 | 0,28 % | ||
| The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not… | The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector… |
Obserwuj | 8,8 | 0,28 % | ||
| The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it… | The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute… |
Obserwuj | 8,8 | 0,28 % | ||
| As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly… | As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases… |
Obserwuj | 8,8 | 0,28 % | ||
| Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain… | Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Obserwuj | 8,8 | 0,28 % | ||
| Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging… | Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High) |
Obserwuj | 8,8 | 0,28 % | ||
| Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social… | Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Obserwuj | 8,8 | 0,28 % | ||
| The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so… | The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder… |
Obserwuj | 8,8 | 0,28 % | ||
| In the Linux kernel, the following vulnerability has been resolved: net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate… | In the Linux kernel, the following vulnerability has been resolved: net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add While doing smcr_port_add, there maybe linkgroup add into or delete from smc_lgr_list.list at the same time, which may result kernel crash. So,… |
Obserwuj | 8,8 | 0,28 % | ||
| Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control… | Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow a low-privilege user to elevate privileges within the application. This issue affects Flipper: 3.1.2. |
Obserwuj | 8,8 | 0,28 % | ||
| Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via… | Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Obserwuj | 8,8 | 0,27 % | ||
| Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via… | Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Obserwuj | 8,8 | 0,27 % | ||
| Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the… | Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Obserwuj | 8,8 | 0,27 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.