KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.
Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
Improper link resolution before file access ('link following') in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.
Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data…
MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without…
Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted…
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.
Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.
Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules. Attackers can inject instructions into repository files or fetched pages so the agent appends commands after…
HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored…
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files.
Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network.
A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUERY to cause a denial of service and possibly disclose or corrupt memory. The function accepts a --bolt argument from any…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
Obserwuj | 7,8 | Nieustalone | ||
| Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges… | Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. |
Obserwuj | 7,8 | Nieustalone | ||
| Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate… | Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally. |
Obserwuj | 7,8 | Nieustalone | ||
| Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges… | Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. |
Obserwuj | 7,8 | Nieustalone | ||
| Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally. | Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally. |
Obserwuj | 7,8 | Nieustalone | ||
| Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally. | Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally. |
Obserwuj | 7,8 | Nieustalone | ||
| Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges… | Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally. |
Obserwuj | 7,8 | Nieustalone | ||
| Improper link resolution before file access ('link following') in Microsoft Defender for Endpoint allows an authorized attacker to elevate… | Improper link resolution before file access ('link following') in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally. |
Obserwuj | 7,8 | Nieustalone | ||
| Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges… | Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. |
Obserwuj | 7,8 | Nieustalone | ||
| Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
Obserwuj | 7,8 | Nieustalone | ||
| Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally. | Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally. |
Obserwuj | 7,8 | Nieustalone | ||
| Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally. | Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally. |
Obserwuj | 7,8 | Nieustalone | ||
| NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a… | NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering. |
Obserwuj | 7,8 | Nieustalone | ||
| NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. | NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service. |
Obserwuj | 7,8 | Nieustalone | ||
| NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a… | NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data… |
Obserwuj | 7,8 | Nieustalone | ||
| MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with… | MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without… |
Obserwuj | 7,7 | 0,45 % | ||
| Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions. | Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions. |
Obserwuj | 7,7 | 0,45 % | ||
| Backstage is an open framework for building developer portals. | Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted… |
Obserwuj | 7,7 | 0,44 % | ||
| IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote… | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command. |
Obserwuj | 7,7 | 0,42 % | ||
| Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions. | Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions. |
Obserwuj | 7,7 | 0,4 % | ||
| Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands… | Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules. Attackers can inject instructions into repository files or fetched pages so the agent appends commands after… |
Obserwuj | 7,7 | 0,4 % | ||
| HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated… | HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored… |
Obserwuj | 7,7 | 0,39 % | ||
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply… | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files. |
Obserwuj | 7,7 | 0,39 % | ||
| Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network. | Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network. |
Obserwuj | 7,7 | 0,37 % | ||
| A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote… | A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUERY to cause a denial of service and possibly disclose or corrupt memory. The function accepts a --bolt argument from any… |
Obserwuj | 7,7 | 0,35 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.