Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context. To remediate this issue, users should upgrade to version 11.3.1 or later.
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
skb_zerocopy() copies frags from @from into @to. On an
skb_orphan_frags() failure it calls skb_tx_error(@from), a destructive
operation on the source skb the…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted.
An attacker can remove the signature from the XML document to make it pass the verification check.
XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
RansomLook does not consistently
enforce authorization checks when accessing groups, markets, and ransom
notes marked as private. An unauthenticated or otherwise unauthorized
remote attacker can access information associated with private entities
through several web views and API…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,66 % · rekomendacja wg zapisanej polityki
In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined.…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 2,66 % · rekomendacja wg zapisanej polityki
Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 1,15 % · rekomendacja wg zapisanej polityki
A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 1,15 % · rekomendacja wg zapisanej polityki
An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 1,15 % · rekomendacja wg zapisanej polityki
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,65 % · rekomendacja wg zapisanej polityki
A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer causes privilege defined with unsafe actions. The attack…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,65 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_diagnosis in file /usr/lib/lua/luci/controller/admin/diagnosis.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 2,64 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 2,64 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
Opis źródłowy NVD · ENCVSS 8,8 · EPSS 2,64 % · rekomendacja wg zapisanej polityki
CVSS
8,8
EPSS
2,64 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context. To remediate this issue, users should upgrade to version 11.3.1 or later.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
skb_zerocopy() copies frags from @from into @to. On an
skb_orphan_frags() failure it calls skb_tx_error(@from), a destructive
operation on the source skb the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted.
An attacker can remove the signature from the XML document to make it pass the verification check.
XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki
RansomLook does not consistently
enforce authorization checks when accessing groups, markets, and ransom
notes marked as private. An unauthenticated or otherwise unauthorized
remote attacker can access information associated with private entities
through several web views and API…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,66 % · rekomendacja wg zapisanej polityki
In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined.…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 2,66 % · rekomendacja wg zapisanej polityki
Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,16 % · rekomendacja wg zapisanej polityki
A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 1,15 % · rekomendacja wg zapisanej polityki
A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 1,15 % · rekomendacja wg zapisanej polityki
An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 1,15 % · rekomendacja wg zapisanej polityki
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,65 % · rekomendacja wg zapisanej polityki
A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer causes privilege defined with unsafe actions. The attack…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,65 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_diagnosis in file /usr/lib/lua/luci/controller/admin/diagnosis.lua.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 2,64 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 2,64 % · rekomendacja wg zapisanej polityki
OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 8,8 · EPSS 2,64 % · rekomendacja wg zapisanej polityki
8,8
2,64 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOpóźnione lub nieustalone
NVD · aktualizacjeOpóźnione lub nieustalone
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOpóźnione lub nieustaloneData modelu znajduje się przy rekordzie.