Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Missing minimum size validation in secure context allocation in FreeRTOS-Kernel before 11.3.1 might allow local users to corrupt secure-world heap metadata via an out-of-bounds write with an undersized stack size parameter. To remediate this issue, users should upgrade to version 11.3.1 or later.
Opis źródłowy NVD · ENCVSS 8,3 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Missing privilege verification in the secure context cleanup handler in FreeRTOS-Kernel before 11.3.1 might allow local users to cause a use-after-free condition in secure-world memory via the SVC handler for secure context deallocation. To remediate this issue, users should upgrade to…
Opis źródłowy NVD · ENCVSS 8,3 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive…
Opis źródłowy NVD · ENCVSS 8,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific…
Opis źródłowy NVD · ENCVSS 8,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
A path traversal vulnerability has been identified in WebDAV, which may allow unauthenticated remote attackers to impact the integrity of the device.
Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
Opis źródłowy NVD · ENCVSS 8,2 · EPSS 0,65 % · rekomendacja wg zapisanej polityki
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue…
Opis źródłowy NVD · ENCVSS 8,2 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args() accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious…
Opis źródłowy NVD · ENCVSS 8,3 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
Active debug code for some Intel UEFI reference platforms within Ring 0: Kernel may allow a denial of service and escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data alteration. This result may potentially occur via local…
Opis źródłowy NVD · ENCVSS 8,3 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for…
Opis źródłowy NVD · ENCVSS 8,1 · EPSS 1,13 % · rekomendacja wg zapisanej polityki
AMI APTIOV contains vulnerabilities
in BIOS where users may cause “Buffer Access with Incorrect Length
Value” by local access. Successful exploitation of this vulnerability could
lead to buffer overflows, memory corruption, and arbitrary code execution, and
also impact Confidentiality, Integrity,…
Opis źródłowy NVD · ENCVSS 8,3 · EPSS 0,12 % · rekomendacja wg zapisanej polityki
Missing minimum size validation in secure context allocation in FreeRTOS-Kernel before 11.3.1 might allow local users to corrupt secure-world heap metadata via an out-of-bounds write with an undersized stack size parameter. To remediate this issue, users should upgrade to version 11.3.1 or later.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,3 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
Missing privilege verification in the secure context cleanup handler in FreeRTOS-Kernel before 11.3.1 might allow local users to cause a use-after-free condition in secure-world memory via the SVC handler for secure context deallocation. To remediate this issue, users should upgrade to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,3 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
A path traversal vulnerability has been identified in WebDAV, which may allow unauthenticated remote attackers to impact the integrity of the device.
Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,2 · EPSS 0,65 % · rekomendacja wg zapisanej polityki
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,2 · EPSS 0,64 % · rekomendacja wg zapisanej polityki
hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args() accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,3 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
Active debug code for some Intel UEFI reference platforms within Ring 0: Kernel may allow a denial of service and escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data alteration. This result may potentially occur via local…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,3 · EPSS 0,13 % · rekomendacja wg zapisanej polityki
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,1 · EPSS 1,13 % · rekomendacja wg zapisanej polityki
AMI APTIOV contains vulnerabilities
in BIOS where users may cause “Buffer Access with Incorrect Length
Value” by local access. Successful exploitation of this vulnerability could
lead to buffer overflows, memory corruption, and arbitrary code execution, and
also impact Confidentiality, Integrity,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,3 · EPSS 0,12 % · rekomendacja wg zapisanej polityki