KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root filesystem. A malicious process on the untrusted host able to…
Obejście ochrony przed przejęciem sesji w MeshCentral pozwala na zdalne przejęcie kontroli nad urządzeniami.
Wstrzyknięcie poleceń w D-Link DIR-895L umożliwia zdalne wykonanie kodu.
Nieprawidłowa walidacja danych w Illustratorze może prowadzić do zdalnego wykonania kodu.
Brak weryfikacji `session_id` w DeepSeek MCP Server pozwala na przejęcie sesji ofiary.
Przekazywanie nagłówków z niezaufanych proxy w Spring Cloud Gateway może prowadzić do ujawnienia danych.
Luka w Illustratorze umożliwia zdalne wykonanie kodu po otwarciu złośliwego pliku.
Nieprawidłowa walidacja danych w Dreamweaver umożliwia zdalne wykonanie kodu po otwarciu złośliwego pliku.
Nieprawidłowa walidacja wejścia w Dreamweaver umożliwia zdalne wykonanie kodu po otwarciu złośliwego pliku.
Otwarte przekierowanie w wtyczce Grav API pozwala na phishing po logowaniu OAuth.
PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with eval(), allowing callback-form keys in untrusted PHP code…
The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing…
bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by…
Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim…
Luka w Photoshop Desktop umożliwia zdalne wykonanie kodu po otwarciu złośliwego pliku.
Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant…
An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it to bypass TLS as a security control.
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access…
Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
Brak ograniczeń w operacji `$import-pnp` w Pathling Server pozwala na nieautoryzowany import danych.
SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. Attackers can create a malicious workspace directory with command metacharacters in its path and trigger the Microsoft Defender exclusion…
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions.
Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. A…
Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Contrast is a confidential-computing runtime for Kubernetes. | Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root filesystem. A malicious process on the untrusted host able to… |
Obserwuj | 8,6 | 0,22 % | ||
| Obejście ochrony przed przejęciem sesji w MeshCentral pozwala na zdalne przejęcie kontroli nad urządzeniami. | Obejście ochrony przed przejęciem sesji w MeshCentral pozwala na zdalne przejęcie kontroli nad urządzeniami. |
Obserwuj | 8,6 | 0,22 % | ||
| Wstrzyknięcie poleceń w D-Link DIR-895L umożliwia zdalne wykonanie kodu. | Wstrzyknięcie poleceń w D-Link DIR-895L umożliwia zdalne wykonanie kodu. |
Obserwuj | 8,3 | 1,72 % | ||
| Nieprawidłowa walidacja danych w Illustratorze może prowadzić do zdalnego wykonania kodu. | Nieprawidłowa walidacja danych w Illustratorze może prowadzić do zdalnego wykonania kodu. |
Obserwuj | 8,6 | 0,22 % | ||
| Brak weryfikacji `session_id` w DeepSeek MCP Server pozwala na przejęcie sesji ofiary. | Brak weryfikacji `session_id` w DeepSeek MCP Server pozwala na przejęcie sesji ofiary. |
Obserwuj | 8,6 | 0,22 % | ||
| Przekazywanie nagłówków z niezaufanych proxy w Spring Cloud Gateway może prowadzić do ujawnienia danych. | Przekazywanie nagłówków z niezaufanych proxy w Spring Cloud Gateway może prowadzić do ujawnienia danych. |
Obserwuj | 8,6 | 0,22 % | ||
| Luka w Illustratorze umożliwia zdalne wykonanie kodu po otwarciu złośliwego pliku. | Luka w Illustratorze umożliwia zdalne wykonanie kodu po otwarciu złośliwego pliku. |
Obserwuj | 8,6 | 0,22 % | ||
| Nieprawidłowa walidacja danych w Dreamweaver umożliwia zdalne wykonanie kodu po otwarciu złośliwego pliku. | Nieprawidłowa walidacja danych w Dreamweaver umożliwia zdalne wykonanie kodu po otwarciu złośliwego pliku. |
Obserwuj | 8,6 | 0,22 % | ||
| Nieprawidłowa walidacja wejścia w Dreamweaver umożliwia zdalne wykonanie kodu po otwarciu złośliwego pliku. | Nieprawidłowa walidacja wejścia w Dreamweaver umożliwia zdalne wykonanie kodu po otwarciu złośliwego pliku. |
Obserwuj | 8,6 | 0,22 % | ||
| Otwarte przekierowanie w wtyczce Grav API pozwala na phishing po logowaniu OAuth. | Otwarte przekierowanie w wtyczce Grav API pozwala na phishing po logowaniu OAuth. |
Obserwuj | 8,6 | 0,22 % | ||
| PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. | PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with eval(), allowing callback-form keys in untrusted PHP code… |
Obserwuj | 8,6 | 0,22 % | ||
| The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password… | The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing… |
Obserwuj | 8,6 | 0,22 % | ||
| bestzip builds the argument list for the system zip utility without separating options from operands. | bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by… |
Obserwuj | 8,6 | 0,21 % | ||
| Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of… | Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim… |
Obserwuj | 8,6 | 0,21 % | ||
| Luka w Photoshop Desktop umożliwia zdalne wykonanie kodu po otwarciu złośliwego pliku. | Luka w Photoshop Desktop umożliwia zdalne wykonanie kodu po otwarciu złośliwego pliku. |
Obserwuj | 8,6 | 0,21 % | ||
| Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing… | Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant… |
Obserwuj | 8,6 | 0,21 % | ||
| An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere… | An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it to bypass TLS as a security control. |
Obserwuj | 8,6 | 0,21 % | ||
| An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions… | An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access… |
Obserwuj | 8,6 | 0,21 % | ||
| Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute… | Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High) |
Obserwuj | 8,6 | 0,21 % | ||
| The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. | The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. |
Obserwuj | 8,6 | 0,21 % | ||
| Brak ograniczeń w operacji `$import-pnp` w Pathling Server pozwala na nieautoryzowany import danych. | Brak ograniczeń w operacji `$import-pnp` w Pathling Server pozwala na nieautoryzowany import danych. |
Obserwuj | 8,6 | 0,21 % | ||
| SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated… | SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. Attackers can create a malicious workspace directory with command metacharacters in its path and trigger the Microsoft Defender exclusion… |
Obserwuj | 8,6 | 0,21 % | ||
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to… | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions. |
Obserwuj | 8,6 | 0,2 % | ||
| Discourse ActivityPub adds ActivityPub support to Discourse. | Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. A… |
Obserwuj | 8,6 | 0,2 % | ||
| Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code… | Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of… |
Obserwuj | 8,6 | 0,2 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.