KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Wykorzystanie luki w BIG-IP i BIG-IQ pozwala na eskalację uprawnień przez atakującego.
Wykonanie poleceń systemowych w BIG-IP DNS pozwala na eskalację uprawnień przez atakującego.
Wykonanie poleceń systemowych w BIG-IP umożliwia atakującemu eskalację uprawnień.
Wykonanie poleceń systemowych w Dreamweaver umożliwia zdalne uruchomienie kodu przez atakującego.
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a…
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template.
The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure…
Brak walidacji parametrów w wtyczce wp-media-folder-addon umożliwia ujawnienie plików i ataki SSRF.
A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP Implicit Connection packets. An attacker on the network can exploit this by sending crafted packets to continuously disrupt device connections, though device…
Luka w hawtio-operator pozwala na kradzież tokenów dostępu przez złośliwe przekierowania.
Nieprawidłowe oczyszczanie danych w GitLab umożliwia wykonanie kodu w sesji innego użytkownika.
W HAX CMS występuje podatność XSS, umożliwiająca atakującym wstrzykiwanie kodu.
Niebezpieczne dereferencje wskaźników w jądrze Windows umożliwiają lokalne podniesienie uprawnień.
A privilege escalation vulnerability exists in the ControlVault WBDI Driver WBIO_USH_ADD_RECORD functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to privilege escalation. An attacker can issue…
Wykorzystanie luki w NGINX Open Source pozwala na zdalne wykonanie kodu.
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who…
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 11). Affected applications do not properly validate client certificates to connect to License Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks.
pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit…
PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exception…
openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false…
Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute…
The lack of cryptographic mechanisms to ensure the integrity and authenticity of communications in Ghost Robotics' Vision 60 robot (APK v5.5.0) exposes the system to man-in-the-middle attacks. An attacker located on the local network can use ARP spoofing and selective traffic blocking techniques…
Brak weryfikacji danych w PLCnext umożliwia zdalne wykonanie kodu z uprawnieniami roota.
An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend.
Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Wykorzystanie luki w BIG-IP i BIG-IQ pozwala na eskalację uprawnień przez atakującego. | Wykorzystanie luki w BIG-IP i BIG-IQ pozwala na eskalację uprawnień przez atakującego. |
Obserwuj | 8,7 | 0,24 % | ||
| Wykonanie poleceń systemowych w BIG-IP DNS pozwala na eskalację uprawnień przez atakującego. | Wykonanie poleceń systemowych w BIG-IP DNS pozwala na eskalację uprawnień przez atakującego. |
Obserwuj | 8,7 | 0,24 % | ||
| Wykonanie poleceń systemowych w BIG-IP umożliwia atakującemu eskalację uprawnień. | Wykonanie poleceń systemowych w BIG-IP umożliwia atakującemu eskalację uprawnień. |
Obserwuj | 8,7 | 0,24 % | ||
| Wykonanie poleceń systemowych w Dreamweaver umożliwia zdalne uruchomienie kodu przez atakującego. | Wykonanie poleceń systemowych w Dreamweaver umożliwia zdalne uruchomienie kodu przez atakującego. |
Obserwuj | 8,6 | 0,74 % | ||
| The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a… |
Obserwuj | 8,7 | 0,24 % | ||
| IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an… | IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template. |
Obserwuj | 8,7 | 0,23 % | ||
| The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by… | The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure… |
Obserwuj | 8,6 | 0,73 % | ||
| Brak walidacji parametrów w wtyczce wp-media-folder-addon umożliwia ujawnienie plików i ataki SSRF. | Brak walidacji parametrów w wtyczce wp-media-folder-addon umożliwia ujawnienie plików i ataki SSRF. |
Obserwuj | 8,6 | 0,73 % | ||
| A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP… | A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP Implicit Connection packets. An attacker on the network can exploit this by sending crafted packets to continuously disrupt device connections, though device… |
Obserwuj | 8,7 | 0,23 % | ||
| Luka w hawtio-operator pozwala na kradzież tokenów dostępu przez złośliwe przekierowania. | Luka w hawtio-operator pozwala na kradzież tokenów dostępu przez złośliwe przekierowania. |
Obserwuj | 8,7 | 0,23 % | ||
| Nieprawidłowe oczyszczanie danych w GitLab umożliwia wykonanie kodu w sesji innego użytkownika. | Nieprawidłowe oczyszczanie danych w GitLab umożliwia wykonanie kodu w sesji innego użytkownika. |
Obserwuj | 8,7 | 0,23 % | ||
| W HAX CMS występuje podatność XSS, umożliwiająca atakującym wstrzykiwanie kodu. | W HAX CMS występuje podatność XSS, umożliwiająca atakującym wstrzykiwanie kodu. |
Obserwuj | 8,7 | 0,23 % | ||
| Niebezpieczne dereferencje wskaźników w jądrze Windows umożliwiają lokalne podniesienie uprawnień. | Niebezpieczne dereferencje wskaźników w jądrze Windows umożliwiają lokalne podniesienie uprawnień. |
Obserwuj | 7,8 | 4,73 % | ||
| A privilege escalation vulnerability exists in the ControlVault WBDI Driver WBIO_USH_ADD_RECORD functionality of Dell ControlVault3 prior… | A privilege escalation vulnerability exists in the ControlVault WBDI Driver WBIO_USH_ADD_RECORD functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to privilege escalation. An attacker can issue… |
Obserwuj | 8,7 | 0,23 % | ||
| Wykorzystanie luki w NGINX Open Source pozwala na zdalne wykonanie kodu. | Wykorzystanie luki w NGINX Open Source pozwala na zdalne wykonanie kodu. |
Obserwuj | 8,1 | 3,23 % | ||
| GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. | GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who… |
Obserwuj | 8,7 | 0,23 % | ||
| A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 11). | A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 11). Affected applications do not properly validate client certificates to connect to License Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks. |
Obserwuj | 8,7 | 0,23 % | ||
| pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute… | pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit… |
Obserwuj | 8,6 | 0,73 % | ||
| PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1… | PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exception… |
Obserwuj | 8,7 | 0,22 % | ||
| openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. | openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false… |
Obserwuj | 8,7 | 0,22 % | ||
| Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in… | Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute… |
Obserwuj | 8,5 | 1,22 % | ||
| The lack of cryptographic mechanisms to ensure the integrity and authenticity of communications in Ghost Robotics' Vision 60 robot (APK… | The lack of cryptographic mechanisms to ensure the integrity and authenticity of communications in Ghost Robotics' Vision 60 robot (APK v5.5.0) exposes the system to man-in-the-middle attacks. An attacker located on the local network can use ARP spoofing and selective traffic blocking techniques… |
Obserwuj | 8,7 | 0,22 % | ||
| Brak weryfikacji danych w PLCnext umożliwia zdalne wykonanie kodu z uprawnieniami roota. | Brak weryfikacji danych w PLCnext umożliwia zdalne wykonanie kodu z uprawnieniami roota. |
Obserwuj | 8,7 | 0,22 % | ||
| An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that… | An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend. |
Obserwuj | 8,7 | 0,22 % | ||
| Plane is an open-source project management tool. | Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a… |
Obserwuj | 8,7 | 0,21 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.