KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A command Injection vulnerability allows attackers to execute arbitrary OS commands…
Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While…
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows…
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Niewłaściwe zarządzanie rejestrami w GIGABYTE APP Center umożliwia nieautoryzowany dostęp do MSR.
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
Nieprawidłowa kontrola dostępu w Citrix Workspace App umożliwia nieautoryzowany dostęp.
Błąd w funkcji n_tty_write w jądrze Linux umożliwia lokalnym użytkownikom eskalację uprawnień lub awarię systemu.
Lokalni użytkownicy mogą uzyskać uprawnienia w Exim przez złośliwą konfigurację.
Nieokreślona podatność w Oracle WebCenter Forms Recognition pozwala zdalnym atakującym naruszyć poufność i integralność.
W podatności SSRF w interfejsie SMA1000 Appliance atakujący może wymusić niezamierzone żądania.
Atak XXE w SAP NetWeaver AS JAVA 7.5 umożliwia zdalnym użytkownikom dostęp do wrażliwych danych.
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this…
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A malicious application may be able to execute arbitrary code with system privileges.
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Brak uwierzytelnienia w MLflow pozwala atakującym na dostęp do wewnętrznych usług.
A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is…
The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0.
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this…
Błąd w weryfikacji bajtów w Adobe Flash Player umożliwia zdalne wykonanie kodu.
A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisco…
Unauthenticated remote arbitrary code execution
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption… | Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Pilne działanie | 8,8 | 13,72 % | ||
| An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through… | An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A command Injection vulnerability allows attackers to execute arbitrary OS commands… |
Pilne działanie | 9,8 | 8,51 % | ||
| Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). | Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While… |
Pilne działanie | 8,8 | 13,4 % | ||
| An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows… | An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows… |
Pilne działanie | 7,8 | 18,39 % | ||
| A use after free issue was addressed with improved memory management. | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. |
Pilne działanie | 8,8 | 13,38 % | ||
| Niewłaściwe zarządzanie rejestrami w GIGABYTE APP Center umożliwia nieautoryzowany dostęp do MSR. | Niewłaściwe zarządzanie rejestrami w GIGABYTE APP Center umożliwia nieautoryzowany dostęp do MSR. |
Pilne działanie | 9,8 | 8,36 % | ||
| Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG… | Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document. |
Pilne działanie | 6,1 | 26,84 % | ||
| Nieprawidłowa kontrola dostępu w Citrix Workspace App umożliwia nieautoryzowany dostęp. | Nieprawidłowa kontrola dostępu w Citrix Workspace App umożliwia nieautoryzowany dostęp. |
Pilne działanie | 9,8 | 8,09 % | ||
| Błąd w funkcji n_tty_write w jądrze Linux umożliwia lokalnym użytkownikom eskalację uprawnień lub awarię systemu. | Błąd w funkcji n_tty_write w jądrze Linux umożliwia lokalnym użytkownikom eskalację uprawnień lub awarię systemu. |
Pilne działanie | 6,9 | 22,48 % | ||
| Lokalni użytkownicy mogą uzyskać uprawnienia w Exim przez złośliwą konfigurację. | Lokalni użytkownicy mogą uzyskać uprawnienia w Exim przez złośliwą konfigurację. |
Pilne działanie | 7,8 | 17,97 % | ||
| Nieokreślona podatność w Oracle WebCenter Forms Recognition pozwala zdalnym atakującym naruszyć poufność i integralność. | Nieokreślona podatność w Oracle WebCenter Forms Recognition pozwala zdalnym atakującym naruszyć poufność i integralność. |
Pilne działanie | 9,8 | 7,83 % | ||
| W podatności SSRF w interfejsie SMA1000 Appliance atakujący może wymusić niezamierzone żądania. | W podatności SSRF w interfejsie SMA1000 Appliance atakujący może wymusić niezamierzone żądania. |
Pilne działanie | 10,0 | 6,8 % | ||
| Atak XXE w SAP NetWeaver AS JAVA 7.5 umożliwia zdalnym użytkownikom dostęp do wrażliwych danych. | Atak XXE w SAP NetWeaver AS JAVA 7.5 umożliwia zdalnym użytkownikom dostęp do wrażliwych danych. |
Pilne działanie | 6,5 | 24,23 % | ||
| A logic issue was addressed with improved restrictions. | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this… |
Pilne działanie | 9,8 | 7,71 % | ||
| A use after free issue was addressed with improved memory management. | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A malicious application may be able to execute arbitrary code with system privileges. |
Pilne działanie | 7,8 | 17,61 % | ||
| Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote… | Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway. |
Pilne działanie | 9,8 | 7,55 % | ||
| Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to… | Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
Pilne działanie | 9,6 | 8,35 % | ||
| Brak uwierzytelnienia w MLflow pozwala atakującym na dostęp do wewnętrznych usług. | Brak uwierzytelnienia w MLflow pozwala atakującym na dostęp do wewnętrznych usług. |
Pilne działanie | 9,3 | 9,84 % | ||
| A use-after-free issue was addressed with improved memory management. | A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is… |
Pilne działanie | 8,8 | 12,17 % | ||
| The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading… | The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0. |
Pilne działanie | 8,8 | 12,08 % | ||
| Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is… | Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection. |
Pilne działanie | 9,8 | 7,08 % | ||
| A logic issue was addressed with improved restrictions. | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this… |
Pilne działanie | 9,8 | 7 % | ||
| Błąd w weryfikacji bajtów w Adobe Flash Player umożliwia zdalne wykonanie kodu. | Błąd w weryfikacji bajtów w Adobe Flash Player umożliwia zdalne wykonanie kodu. |
Pilne działanie | 8,8 | 11,89 % | ||
| A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker… | A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisco… |
Pilne działanie | 8,8 | 11,68 % | ||
| Unauthenticated remote arbitrary code execution | Unauthenticated remote arbitrary code execution |
Pilne działanie | 9,8 | 6,68 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.