KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Wykonanie dowolnego kodu w jądrze iOS umożliwia atakującym eskalację uprawnień lub awarię systemu.
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote…
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a…
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully…
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
Obejście uwierzytelnienia w Cisco Secure Firewall Management Center umożliwia dostęp do danych bez hasła.
Błąd w Cisco ASA pozwala lokalnym użytkownikom uzyskać wyższe uprawnienia przez nieprawidłowe polecenia CLI.
Microsoft Exchange Server Elevation of Privilege Vulnerability
Wstrzyknięcie kodu w Zimbra Collaboration Suite pozwala na wykonanie złośliwego JavaScriptu.
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows…
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7…
Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability.
Luka w jądrze iOS umożliwia pozyskanie wrażliwych danych z pamięci przez złośliwą aplikację.
Błąd w instalatorze Cisco AnyConnect umożliwia lokalnemu atakującemu kopiowanie plików do katalogów systemowych.
Błąd w interfejsie webowym Cisco Catalyst SD-WAN Manager pozwala na nadpisywanie plików przez uwierzytelnionego atakującego.
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3, macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may…
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 (v. 16612.4.9.1.8 and 15612.4.9.1.8). Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a…
Luka XSS w Zimbra Collaboration Suite umożliwia zdalne wstrzyknięcie skryptu przez załącznik.
Nieokreślona podatność w Adobe Reader i Flash Player umożliwia zdalne wykonanie kodu.
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
Awaria mechanizmu ochrony w MSHTML umożliwia atakującemu ominięcie zabezpieczeń.
Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Wykonanie dowolnego kodu w jądrze iOS umożliwia atakującym eskalację uprawnień lub awarię systemu. | Wykonanie dowolnego kodu w jądrze iOS umożliwia atakującym eskalację uprawnień lub awarię systemu. |
Pilne działanie | 7,8 | 23,63 % | ||
| Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to… | Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote… |
Pilne działanie | 7,5 | 25,12 % | ||
| Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap… | Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
Pilne działanie | 8,8 | 18,53 % | ||
| Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a… |
Pilne działanie | 8,1 | 21,78 % | ||
| A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully… |
Pilne działanie | 7,6 | 24,19 % | ||
| SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users,… | SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs. |
Pilne działanie | 6,6 | 28,93 % | ||
| Obejście uwierzytelnienia w Cisco Secure Firewall Management Center umożliwia dostęp do danych bez hasła. | Obejście uwierzytelnienia w Cisco Secure Firewall Management Center umożliwia dostęp do danych bez hasła. |
Pilne działanie | 5,3 | 35,1 % | ||
| Błąd w Cisco ASA pozwala lokalnym użytkownikom uzyskać wyższe uprawnienia przez nieprawidłowe polecenia CLI. | Błąd w Cisco ASA pozwala lokalnym użytkownikom uzyskać wyższe uprawnienia przez nieprawidłowe polecenia CLI. |
Pilne działanie | 7,8 | 22,58 % | ||
| Microsoft Exchange Server Elevation of Privilege Vulnerability | Microsoft Exchange Server Elevation of Privilege Vulnerability |
Pilne działanie | 9,8 | 12,56 % | ||
| Wstrzyknięcie kodu w Zimbra Collaboration Suite pozwala na wykonanie złośliwego JavaScriptu. | Wstrzyknięcie kodu w Zimbra Collaboration Suite pozwala na wykonanie złośliwego JavaScriptu. |
Pilne działanie | 6,1 | 30,93 % | ||
| An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka… | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows… |
Pilne działanie | 7,8 | 22,18 % | ||
| A memory corruption issue was addressed with improved input validation. | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7… |
Pilne działanie | 7,8 | 22,01 % | ||
| Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary… | Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability. |
Pilne działanie | 9,8 | 11,86 % | ||
| Luka w jądrze iOS umożliwia pozyskanie wrażliwych danych z pamięci przez złośliwą aplikację. | Luka w jądrze iOS umożliwia pozyskanie wrażliwych danych z pamięci przez złośliwą aplikację. |
Pilne działanie | 5,5 | 33,35 % | ||
| Błąd w instalatorze Cisco AnyConnect umożliwia lokalnemu atakującemu kopiowanie plików do katalogów systemowych. | Błąd w instalatorze Cisco AnyConnect umożliwia lokalnemu atakującemu kopiowanie plików do katalogów systemowych. |
Pilne działanie | 6,5 | 28,31 % | ||
| Błąd w interfejsie webowym Cisco Catalyst SD-WAN Manager pozwala na nadpisywanie plików przez uwierzytelnionego atakującego. | Błąd w interfejsie webowym Cisco Catalyst SD-WAN Manager pozwala na nadpisywanie plików przez uwierzytelnionego atakującego. |
Pilne działanie | 6,5 | 28,17 % | ||
| A memory corruption issue was addressed with improved input validation. | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3, macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may… |
Pilne działanie | 9,8 | 11,64 % | ||
| Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. | Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later. |
Pilne działanie | 9,8 | 11,41 % | ||
| A use after free issue was addressed with improved memory management. | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 (v. 16612.4.9.1.8 and 15612.4.9.1.8). Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a… |
Pilne działanie | 8,8 | 16,34 % | ||
| Luka XSS w Zimbra Collaboration Suite umożliwia zdalne wstrzyknięcie skryptu przez załącznik. | Luka XSS w Zimbra Collaboration Suite umożliwia zdalne wstrzyknięcie skryptu przez załącznik. |
Pilne działanie | 6,1 | 29,76 % | ||
| Nieokreślona podatność w Adobe Reader i Flash Player umożliwia zdalne wykonanie kodu. | Nieokreślona podatność w Adobe Reader i Flash Player umożliwia zdalne wykonanie kodu. |
Pilne działanie | 7,8 | 21,2 % | ||
| A type confusion issue was addressed with improved memory handling. | A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution. |
Pilne działanie | 8,8 | 16,16 % | ||
| Awaria mechanizmu ochrony w MSHTML umożliwia atakującemu ominięcie zabezpieczeń. | Awaria mechanizmu ochrony w MSHTML umożliwia atakującemu ominięcie zabezpieczeń. |
Pilne działanie | 8,8 | 15,85 % | ||
| Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to… | Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. |
Pilne działanie | 9,6 | 11,74 % | ||
| Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for… | Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x. |
Pilne działanie | 9,8 | 10,67 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.