Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
A local privilege escalation vulnerability exists in
the restore mechanism of
ASUS System Control Interface. It can be triggered when an unprivileged actor copies files without proper validation into protected system paths, potentially leading to arbitrary files being executed as SYSTEM.
For…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
An Improper Access Control vulnerability in Advantech SUSI driver (susi.sys) allows attackers to read/write arbitrary memory, I/O ports, and MSRs, resulting in privilege escalation, arbitrary code execution, and information disclosure. This issue affects Advantech SUSI: 5.0.24335 and prior.
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process.
Refer to the '
Security Update for Armoury Crate App '…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
QND Premium/Advance/Standard Ver.11.0.9i and prior contains a privilege escalation vulnerability, which may allow a user who can log in to a Windows system with the affected product to gain administrator privileges. As a result, sensitive information may be accessed or altered, and arbitrary…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
An improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code with elevated privileges.
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file path and bypassing the service’s path restrictions . On…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Management Console or Client Terminal for the product is running…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,1 % · rekomendacja wg zapisanej polityki
Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable.
This issue affects ADVMS: before 3.10.
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,1 % · rekomendacja wg zapisanej polityki
Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,09 % · rekomendacja wg zapisanej polityki
Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,08 % · rekomendacja wg zapisanej polityki
MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell…
Opis źródłowy NVD · ENCVSS 8,5 · EPSS 0,07 % · rekomendacja wg zapisanej polityki
A local privilege escalation vulnerability exists in
the restore mechanism of
ASUS System Control Interface. It can be triggered when an unprivileged actor copies files without proper validation into protected system paths, potentially leading to arbitrary files being executed as SYSTEM.
For…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
An Improper Access Control vulnerability in Advantech SUSI driver (susi.sys) allows attackers to read/write arbitrary memory, I/O ports, and MSRs, resulting in privilege escalation, arbitrary code execution, and information disclosure. This issue affects Advantech SUSI: 5.0.24335 and prior.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process.
Refer to the '
Security Update for Armoury Crate App '…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
QND Premium/Advance/Standard Ver.11.0.9i and prior contains a privilege escalation vulnerability, which may allow a user who can log in to a Windows system with the affected product to gain administrator privileges. As a result, sensitive information may be accessed or altered, and arbitrary…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
An improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code with elevated privileges.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file path and bypassing the service’s path restrictions . On…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,11 % · rekomendacja wg zapisanej polityki
An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Management Console or Client Terminal for the product is running…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,1 % · rekomendacja wg zapisanej polityki
Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable.
This issue affects ADVMS: before 3.10.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,1 % · rekomendacja wg zapisanej polityki
Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,09 % · rekomendacja wg zapisanej polityki
Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,08 % · rekomendacja wg zapisanej polityki
MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,5 · EPSS 0,07 % · rekomendacja wg zapisanej polityki