KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Wstrzyknięcie poleceń SMTP w Nodemailer umożliwia dodanie kontrolowanych przez atakującego odbiorców.
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue…
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may…
W Etherpad przed 3.3.1 występuje XSS umożliwiające wykonanie kodu przez użytkowników z dostępem do edytora.
Błąd w sigstore-js pozwala na nieautoryzowane przesyłanie poświadczeń do niewłaściwego rejestru.
Luka w Vault Secrets Operator umożliwia odczyt plików i wyciek poświadczeń, co może prowadzić do eskalacji uprawnień.
Luka w Oracle Enterprise Manager umożliwia przejęcie kontroli przez nieautoryzowanego atakującego.
The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute…
Niewystarczająca walidacja danych w ANGLE w Google Chrome umożliwia zdalne wyjście z piaskownicy.
Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an…
Brak weryfikacji właściciela w Termix pozwala na ujawnienie haseł innych użytkowników.
Błąd w Termix umożliwia uwierzytelnienie do złośliwego serwera SSH i ujawnienie danych użytkownika.
Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Use after free in Views in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Use after free in Views in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Use after free in Views in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Improper input validation in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in Bluetooth in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Use after free in FedCM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Use after free in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Wstrzyknięcie poleceń SMTP w Nodemailer umożliwia dodanie kontrolowanych przez atakującego odbiorców. | Wstrzyknięcie poleceń SMTP w Nodemailer umożliwia dodanie kontrolowanych przez atakującego odbiorców. |
W tym tygodniu | 9,3 | 1,98 % | ||
| Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result… | Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue… |
W tym tygodniu | 9,6 | 0,48 % | ||
| Backstage is an open framework for building developer portals. | Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may… |
W tym tygodniu | 9,6 | 0,47 % | ||
| W Etherpad przed 3.3.1 występuje XSS umożliwiające wykonanie kodu przez użytkowników z dostępem do edytora. | W Etherpad przed 3.3.1 występuje XSS umożliwiające wykonanie kodu przez użytkowników z dostępem do edytora. |
W tym tygodniu | 9,6 | 0,47 % | ||
| Błąd w sigstore-js pozwala na nieautoryzowane przesyłanie poświadczeń do niewłaściwego rejestru. | Błąd w sigstore-js pozwala na nieautoryzowane przesyłanie poświadczeń do niewłaściwego rejestru. |
W tym tygodniu | 9,6 | 0,47 % | ||
| Luka w Vault Secrets Operator umożliwia odczyt plików i wyciek poświadczeń, co może prowadzić do eskalacji uprawnień. | Luka w Vault Secrets Operator umożliwia odczyt plików i wyciek poświadczeń, co może prowadzić do eskalacji uprawnień. |
W tym tygodniu | 9,6 | 0,47 % | ||
| Luka w Oracle Enterprise Manager umożliwia przejęcie kontroli przez nieautoryzowanego atakującego. | Luka w Oracle Enterprise Manager umożliwia przejęcie kontroli przez nieautoryzowanego atakującego. |
W tym tygodniu | 9,6 | 0,47 % | ||
| The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View… | The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute… |
W tym tygodniu | 9,5 | 0,97 % | ||
| Niewystarczająca walidacja danych w ANGLE w Google Chrome umożliwia zdalne wyjście z piaskownicy. | Niewystarczająca walidacja danych w ANGLE w Google Chrome umożliwia zdalne wyjście z piaskownicy. |
W tym tygodniu | 9,6 | 0,47 % | ||
| Kyverno is a policy engine designed for cloud native platform engineering teams. | Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an… |
W tym tygodniu | 9,6 | 0,47 % | ||
| Brak weryfikacji właściciela w Termix pozwala na ujawnienie haseł innych użytkowników. | Brak weryfikacji właściciela w Termix pozwala na ujawnienie haseł innych użytkowników. |
W tym tygodniu | 9,6 | 0,46 % | ||
| Błąd w Termix umożliwia uwierzytelnienie do złośliwego serwera SSH i ujawnienie danych użytkownika. | Błąd w Termix umożliwia uwierzytelnienie do złośliwego serwera SSH i ujawnienie danych użytkownika. |
W tym tygodniu | 9,6 | 0,46 % | ||
| Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially… | Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
W tym tygodniu | 9,6 | 0,46 % | ||
| Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via… | Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
W tym tygodniu | 9,6 | 0,46 % | ||
| Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the… | Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
W tym tygodniu | 9,6 | 0,46 % | ||
| Use after free in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox… | Use after free in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
W tym tygodniu | 9,6 | 0,46 % | ||
| Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via… | Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
W tym tygodniu | 9,6 | 0,46 % | ||
| Use after free in Views in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the… | Use after free in Views in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
W tym tygodniu | 9,6 | 0,46 % | ||
| Use after free in Views in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the… | Use after free in Views in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
W tym tygodniu | 9,6 | 0,46 % | ||
| Use after free in Views in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the… | Use after free in Views in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
W tym tygodniu | 9,6 | 0,46 % | ||
| Improper input validation in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code… | Improper input validation in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
W tym tygodniu | 9,6 | 0,46 % | ||
| Use after free in Bluetooth in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to… | Use after free in Bluetooth in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
W tym tygodniu | 9,6 | 0,46 % | ||
| Use after free in FedCM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute… | Use after free in FedCM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
W tym tygodniu | 9,6 | 0,46 % | ||
| Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via… | Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
W tym tygodniu | 9,6 | 0,46 % | ||
| Use after free in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code… | Use after free in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
W tym tygodniu | 9,6 | 0,46 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.