KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted…
Windows Print Spooler Elevation of Privilege Vulnerability
Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Luka w rozszerzeniu Balbooa Forms umożliwia nieautoryzowane przesyłanie plików i zdalne wykonanie kodu.
goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_user<*1*>administrator<*1*>123456 request.
Microsoft Streaming Service Elevation of Privilege Vulnerability
Przechodzenie katalogów w ONLYOFFICE Document Server umożliwia zdalne wykonanie kodu.
Wykonanie zdalnego kodu przed uwierzytelnieniem w N-central zagraża bezpieczeństwu systemu.
Wykorzystanie luki w jądrze Windows umożliwia lokalnym użytkownikom eskalację uprawnień.
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized…
Przepełnienie całkowitej liczby w Adobe Flash Player umożliwia zdalne wykonanie kodu.
Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges. The vulnerability is due to incorrect bounds…
Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerability could cause information leakage.
Słabość uwierzytelniania w JFrog Artifactory umożliwia zdobycie uprawnień administratora.
Obejście uwierzytelnienia wskaźników w systemach Apple umożliwia atakującemu zdalne manipulowanie danymi.
The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.
Wykorzystanie błędu use after free w Adobe Flash Player pozwala na zdalne wykonanie kodu.
Przepełnienie bufora w DHCP relay w Cisco IOS pozwala na zdalne wykonanie kodu lub DoS.
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management…
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. | Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user. |
Pilne działanie | 7,8 | 25,06 % | ||
| A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. | A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted… |
Pilne działanie | 10,0 | 14,03 % | ||
| Windows Print Spooler Elevation of Privilege Vulnerability | Windows Print Spooler Elevation of Privilege Vulnerability |
Pilne działanie | 4,6 | 41,01 % | ||
| Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a… | Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Pilne działanie | 8,8 | 19,97 % | ||
| Luka w rozszerzeniu Balbooa Forms umożliwia nieautoryzowane przesyłanie plików i zdalne wykonanie kodu. | Luka w rozszerzeniu Balbooa Forms umożliwia nieautoryzowane przesyłanie plików i zdalne wykonanie kodu. |
Pilne działanie | 9,8 | 14,85 % | ||
| goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges… | goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_user<*1*>administrator<*1*>123456 request. |
Pilne działanie | 9,8 | 14,67 % | ||
| Microsoft Streaming Service Elevation of Privilege Vulnerability | Microsoft Streaming Service Elevation of Privilege Vulnerability |
Pilne działanie | 8,4 | 21,62 % | ||
| Przechodzenie katalogów w ONLYOFFICE Document Server umożliwia zdalne wykonanie kodu. | Przechodzenie katalogów w ONLYOFFICE Document Server umożliwia zdalne wykonanie kodu. |
Pilne działanie | 9,8 | 14,55 % | ||
| Wykonanie zdalnego kodu przed uwierzytelnieniem w N-central zagraża bezpieczeństwu systemu. | Wykonanie zdalnego kodu przed uwierzytelnieniem w N-central zagraża bezpieczeństwu systemu. |
Pilne działanie | 9,8 | 14,51 % | ||
| Wykorzystanie luki w jądrze Windows umożliwia lokalnym użytkownikom eskalację uprawnień. | Wykorzystanie luki w jądrze Windows umożliwia lokalnym użytkownikom eskalację uprawnień. |
Pilne działanie | 7,8 | 24,47 % | ||
| An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. | An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php. |
Pilne działanie | 6,1 | 32,92 % | ||
| This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. | This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions. |
Pilne działanie | 9,8 | 14,37 % | ||
| Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. | Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized… |
Pilne działanie | 10,0 | 13,35 % | ||
| Przepełnienie całkowitej liczby w Adobe Flash Player umożliwia zdalne wykonanie kodu. | Przepełnienie całkowitej liczby w Adobe Flash Player umożliwia zdalne wykonanie kodu. |
Pilne działanie | 8,8 | 19,33 % | ||
| Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a… | Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
Pilne działanie | 9,6 | 15,24 % | ||
| A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated,… | A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges. The vulnerability is due to incorrect bounds… |
Pilne działanie | 9,8 | 14,2 % | ||
| Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to… | Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerability could cause information leakage. |
Pilne działanie | 7,5 | 25,7 % | ||
| Słabość uwierzytelniania w JFrog Artifactory umożliwia zdobycie uprawnień administratora. | Słabość uwierzytelniania w JFrog Artifactory umożliwia zdobycie uprawnień administratora. |
Pilne działanie | 9,8 | 14,12 % | ||
| Obejście uwierzytelnienia wskaźników w systemach Apple umożliwia atakującemu zdalne manipulowanie danymi. | Obejście uwierzytelnienia wskaźników w systemach Apple umożliwia atakującemu zdalne manipulowanie danymi. |
Pilne działanie | 9,8 | 13,97 % | ||
| The issue was addressed with improved checks. | The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. |
Pilne działanie | 8,8 | 18,95 % | ||
| VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection… | VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability. |
Pilne działanie | 9,1 | 17,3 % | ||
| Wykorzystanie błędu use after free w Adobe Flash Player pozwala na zdalne wykonanie kodu. | Wykorzystanie błędu use after free w Adobe Flash Player pozwala na zdalne wykonanie kodu. |
Pilne działanie | 8,8 | 18,79 % | ||
| Przepełnienie bufora w DHCP relay w Cisco IOS pozwala na zdalne wykonanie kodu lub DoS. | Przepełnienie bufora w DHCP relay w Cisco IOS pozwala na zdalne wykonanie kodu lub DoS. |
Pilne działanie | 9,8 | 13,77 % | ||
| VMware ESXi contains an authentication bypass vulnerability. | VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management… |
Pilne działanie | 7,2 | 26,77 % | ||
| It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the… | It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this… |
Pilne działanie | 7,8 | 23,71 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.