KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Atak na pakiety @tanstack/* w npm umożliwia publikację złośliwego oprogramowania pod zaufaną tożsamością.
Windows MSHTML Platform Elevation of Privilege Vulnerability
Luka w Cisco AnyConnect umożliwia atak DLL hijacking z uprawnieniami SYSTEM.
Podatność w sterownikach jądra Windows umożliwia lokalnym użytkownikom eskalację uprawnień.
Typowe pomylenie w V8 w Google Chrome umożliwia zdalnemu atakującemu potencjalne wykorzystanie uszkodzenia sterty.
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the…
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator…
Obejście uwierzytelnienia w Apple OS X umożliwia lokalnym użytkownikom uzyskanie uprawnień administratora.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.
Luka w BIG-IP APM umożliwia zdalne wykonanie kodu przez złośliwy ruch.
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned…
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth…
Wstrzyknięcie obiektu PHP w Mirasvit Full Page Cache Warmer umożliwia zdalne wykonanie kodu.
Wykonanie zdalnego kodu w Microsoft Office umożliwia atakującym przejęcie kontroli nad systemem.
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed…
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS…
Obejście zabezpieczeń w Microsoft Publisher umożliwia nieautoryzowany dostęp do danych.
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report…
Wstrzyknięcie skryptów w QNAP umożliwia zdalne wykonanie złośliwego kodu.
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software…
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack…
Microsoft WordPad Information Disclosure Vulnerability
Windows SmartScreen Security Feature Bypass Vulnerability
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Atak na pakiety @tanstack/* w npm umożliwia publikację złośliwego oprogramowania pod zaufaną tożsamością. | Atak na pakiety @tanstack/* w npm umożliwia publikację złośliwego oprogramowania pod zaufaną tożsamością. |
Pilne działanie | 9,6 | 1,05 % | ||
| Windows MSHTML Platform Elevation of Privilege Vulnerability | Windows MSHTML Platform Elevation of Privilege Vulnerability |
Pilne działanie | 7,8 | 10,05 % | ||
| Luka w Cisco AnyConnect umożliwia atak DLL hijacking z uprawnieniami SYSTEM. | Luka w Cisco AnyConnect umożliwia atak DLL hijacking z uprawnieniami SYSTEM. |
Pilne działanie | 7,8 | 10,05 % | ||
| Podatność w sterownikach jądra Windows umożliwia lokalnym użytkownikom eskalację uprawnień. | Podatność w sterownikach jądra Windows umożliwia lokalnym użytkownikom eskalację uprawnień. |
Pilne działanie | 7,8 | 10,03 % | ||
| Typowe pomylenie w V8 w Google Chrome umożliwia zdalnemu atakującemu potencjalne wykorzystanie uszkodzenia sterty. | Typowe pomylenie w V8 w Google Chrome umożliwia zdalnemu atakującemu potencjalne wykorzystanie uszkodzenia sterty. |
Pilne działanie | 8,8 | 5,03 % | ||
| Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability |
Pilne działanie | 7,8 | 9,99 % | ||
| An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security… | An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the… |
Pilne działanie | 8,8 | 4,95 % | ||
| Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been… | Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator… |
Pilne działanie | 7,8 | 9,89 % | ||
| Obejście uwierzytelnienia w Apple OS X umożliwia lokalnym użytkownikom uzyskanie uprawnień administratora. | Obejście uwierzytelnienia w Apple OS X umożliwia lokalnym użytkownikom uzyskanie uprawnień administratora. |
Pilne działanie | 7,8 | 9,89 % | ||
| An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka… | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. |
Pilne działanie | 7,8 | 9,87 % | ||
| Luka w BIG-IP APM umożliwia zdalne wykonanie kodu przez złośliwy ruch. | Luka w BIG-IP APM umożliwia zdalne wykonanie kodu przez złośliwy ruch. |
Pilne działanie | 9,3 | 2,3 % | ||
| Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the… | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned… |
Pilne działanie | 7,8 | 9,75 % | ||
| When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote… | When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth… |
Pilne działanie | 9,3 | 2,23 % | ||
| Wstrzyknięcie obiektu PHP w Mirasvit Full Page Cache Warmer umożliwia zdalne wykonanie kodu. | Wstrzyknięcie obiektu PHP w Mirasvit Full Page Cache Warmer umożliwia zdalne wykonanie kodu. |
Pilne działanie | 9,3 | 2,09 % | ||
| Wykonanie zdalnego kodu w Microsoft Office umożliwia atakującym przejęcie kontroli nad systemem. | Wykonanie zdalnego kodu w Microsoft Office umożliwia atakującym przejęcie kontroli nad systemem. |
Pilne działanie | 8,5 | 6,08 % | ||
| VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal… | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed… |
Pilne działanie | 9,5 | 1,06 % | ||
| The issue was addressed with improved checks. | The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS… |
Pilne działanie | 7,8 | 9,52 % | ||
| Obejście zabezpieczeń w Microsoft Publisher umożliwia nieautoryzowany dostęp do danych. | Obejście zabezpieczeń w Microsoft Publisher umożliwia nieautoryzowany dostęp do danych. |
Pilne działanie | 7,3 | 12,01 % | ||
| A use after free issue was addressed with improved memory management. | A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report… |
Pilne działanie | 8,8 | 4,49 % | ||
| Wstrzyknięcie skryptów w QNAP umożliwia zdalne wykonanie złośliwego kodu. | Wstrzyknięcie skryptów w QNAP umożliwia zdalne wykonanie złośliwego kodu. |
Pilne działanie | 5,4 | 21,48 % | ||
| An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with… | An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software… |
Pilne działanie | 8,8 | 4,47 % | ||
| A flaw has been found in Ahsay AhsayCBS up to 10.3.2. | A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack… |
Pilne działanie | 9,3 | 1,84 % | ||
| Microsoft WordPad Information Disclosure Vulnerability | Microsoft WordPad Information Disclosure Vulnerability |
Pilne działanie | 5,5 | 20,72 % | ||
| Windows SmartScreen Security Feature Bypass Vulnerability | Windows SmartScreen Security Feature Bypass Vulnerability |
Pilne działanie | 8,8 | 4,16 % | ||
| A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0… | A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters. |
Pilne działanie | 6,1 | 17,63 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.