KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Wykonanie zdalnego kodu przed uwierzytelnieniem w N-central zagraża bezpieczeństwu systemu.
Wykorzystanie luki w jądrze Windows umożliwia lokalnym użytkownikom eskalację uprawnień.
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized…
Przepełnienie całkowitej liczby w Adobe Flash Player umożliwia zdalne wykonanie kodu.
Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges. The vulnerability is due to incorrect bounds…
Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerability could cause information leakage.
Słabość uwierzytelniania w JFrog Artifactory umożliwia zdobycie uprawnień administratora.
Obejście uwierzytelnienia wskaźników w systemach Apple umożliwia atakującemu zdalne manipulowanie danymi.
The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.
Wykorzystanie błędu use after free w Adobe Flash Player pozwala na zdalne wykonanie kodu.
Przepełnienie bufora w DHCP relay w Cisco IOS pozwala na zdalne wykonanie kodu lub DoS.
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management…
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this…
Wykonanie dowolnego kodu w jądrze iOS umożliwia atakującym eskalację uprawnień lub awarię systemu.
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote…
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a…
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully…
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
Obejście uwierzytelnienia w Cisco Secure Firewall Management Center umożliwia dostęp do danych bez hasła.
Błąd w Cisco ASA pozwala lokalnym użytkownikom uzyskać wyższe uprawnienia przez nieprawidłowe polecenia CLI.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Wykonanie zdalnego kodu przed uwierzytelnieniem w N-central zagraża bezpieczeństwu systemu. | Wykonanie zdalnego kodu przed uwierzytelnieniem w N-central zagraża bezpieczeństwu systemu. |
Pilne działanie | 9,8 | 14,51 % | ||
| Wykorzystanie luki w jądrze Windows umożliwia lokalnym użytkownikom eskalację uprawnień. | Wykorzystanie luki w jądrze Windows umożliwia lokalnym użytkownikom eskalację uprawnień. |
Pilne działanie | 7,8 | 24,47 % | ||
| An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. | An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php. |
Pilne działanie | 6,1 | 32,92 % | ||
| This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. | This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions. |
Pilne działanie | 9,8 | 14,37 % | ||
| Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. | Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized… |
Pilne działanie | 10,0 | 13,35 % | ||
| Przepełnienie całkowitej liczby w Adobe Flash Player umożliwia zdalne wykonanie kodu. | Przepełnienie całkowitej liczby w Adobe Flash Player umożliwia zdalne wykonanie kodu. |
Pilne działanie | 8,8 | 19,33 % | ||
| Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a… | Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
Pilne działanie | 9,6 | 15,24 % | ||
| A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated,… | A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges. The vulnerability is due to incorrect bounds… |
Pilne działanie | 9,8 | 14,2 % | ||
| Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to… | Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerability could cause information leakage. |
Pilne działanie | 7,5 | 25,7 % | ||
| Słabość uwierzytelniania w JFrog Artifactory umożliwia zdobycie uprawnień administratora. | Słabość uwierzytelniania w JFrog Artifactory umożliwia zdobycie uprawnień administratora. |
Pilne działanie | 9,8 | 14,12 % | ||
| Obejście uwierzytelnienia wskaźników w systemach Apple umożliwia atakującemu zdalne manipulowanie danymi. | Obejście uwierzytelnienia wskaźników w systemach Apple umożliwia atakującemu zdalne manipulowanie danymi. |
Pilne działanie | 9,8 | 13,97 % | ||
| The issue was addressed with improved checks. | The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. |
Pilne działanie | 8,8 | 18,95 % | ||
| VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection… | VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability. |
Pilne działanie | 9,1 | 17,3 % | ||
| Wykorzystanie błędu use after free w Adobe Flash Player pozwala na zdalne wykonanie kodu. | Wykorzystanie błędu use after free w Adobe Flash Player pozwala na zdalne wykonanie kodu. |
Pilne działanie | 8,8 | 18,79 % | ||
| Przepełnienie bufora w DHCP relay w Cisco IOS pozwala na zdalne wykonanie kodu lub DoS. | Przepełnienie bufora w DHCP relay w Cisco IOS pozwala na zdalne wykonanie kodu lub DoS. |
Pilne działanie | 9,8 | 13,77 % | ||
| VMware ESXi contains an authentication bypass vulnerability. | VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management… |
Pilne działanie | 7,2 | 26,77 % | ||
| It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the… | It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this… |
Pilne działanie | 7,8 | 23,71 % | ||
| Wykonanie dowolnego kodu w jądrze iOS umożliwia atakującym eskalację uprawnień lub awarię systemu. | Wykonanie dowolnego kodu w jądrze iOS umożliwia atakującym eskalację uprawnień lub awarię systemu. |
Pilne działanie | 7,8 | 23,63 % | ||
| Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to… | Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote… |
Pilne działanie | 7,5 | 25,12 % | ||
| Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap… | Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
Pilne działanie | 8,8 | 18,53 % | ||
| Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a… |
Pilne działanie | 8,1 | 21,78 % | ||
| A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully… |
Pilne działanie | 7,6 | 24,19 % | ||
| SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users,… | SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs. |
Pilne działanie | 6,6 | 28,93 % | ||
| Obejście uwierzytelnienia w Cisco Secure Firewall Management Center umożliwia dostęp do danych bez hasła. | Obejście uwierzytelnienia w Cisco Secure Firewall Management Center umożliwia dostęp do danych bez hasła. |
Pilne działanie | 5,3 | 35,1 % | ||
| Błąd w Cisco ASA pozwala lokalnym użytkownikom uzyskać wyższe uprawnienia przez nieprawidłowe polecenia CLI. | Błąd w Cisco ASA pozwala lokalnym użytkownikom uzyskać wyższe uprawnienia przez nieprawidłowe polecenia CLI. |
Pilne działanie | 7,8 | 22,58 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.