KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Rejected reason: This CVE's publication may have been a false positive or a mistake. As a result, we have rejected this record.
"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that…
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due…
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an attacker to manipulate certain agent client components. An attempted attack requires user authentication.
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated…
Wykorzystanie podatności w GDI w Windows pozwala lokalnym użytkownikom na eskalację uprawnień.
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
Przepełnienie bufora w NetScaler ADC i Gateway prowadzi do błędów i odmowy usługi.
Wtyczka LiteSpeed User-End cPanel przed 2.4.5 pozwala na eskalację uprawnień do roota.
Windows DWM Core Library Elevation of Privilege Vulnerability
Podatność w sterowniku Windows Common Log File System umożliwia eskalację uprawnień.
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
Luka w Oracle Payments pozwala zdalnie przejąć kontrolę nad systemem.
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack…
A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.
Błąd w load_elf_binary w jądrze Linux umożliwia atakującym przepełnienie pamięci i wykonanie kodu.
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability…
A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass security features and load improperly signed files. In an attack scenario, an attacker could bypass security features intended to prevent…
Błąd w Cisco ASA i FTD umożliwia lokalnemu atakującemu wykonanie dowolnego kodu.
The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieve read/write access to read-only pages. This affects Bifrost r0p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r8p0…
A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7…
Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets.
Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Rejected reason: This CVE's publication may have been a false positive or a mistake. | Rejected reason: This CVE's publication may have been a false positive or a mistake. As a result, we have rejected this record. |
Pilne działanie | 7,5 | 12,71 % | ||
| "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced… | "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that… |
Pilne działanie | 9,8 | 1,2 % | ||
| A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an… | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due… |
Pilne działanie | 8,6 | 7,19 % | ||
| The vulnerability exists within internal components of BeyondTrust’s Remote Support product. | The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance. |
Pilne działanie | 9,8 | 1,18 % | ||
| Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation… | Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an attacker to manipulate certain agent client components. An attempted attack requires user authentication. |
Pilne działanie | 8,8 | 6,17 % | ||
| A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated… | A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface. |
Pilne działanie | 7,2 | 14,15 % | ||
| Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated… |
Pilne działanie | 9,8 | 1,08 % | ||
| Wykorzystanie podatności w GDI w Windows pozwala lokalnym użytkownikom na eskalację uprawnień. | Wykorzystanie podatności w GDI w Windows pozwala lokalnym użytkownikom na eskalację uprawnień. |
Pilne działanie | 7,8 | 11,02 % | ||
| Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a… | Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. |
Pilne działanie | 9,8 | 1,01 % | ||
| Przepełnienie bufora w NetScaler ADC i Gateway prowadzi do błędów i odmowy usługi. | Przepełnienie bufora w NetScaler ADC i Gateway prowadzi do błędów i odmowy usługi. |
Pilne działanie | 9,8 | 1,01 % | ||
| Wtyczka LiteSpeed User-End cPanel przed 2.4.5 pozwala na eskalację uprawnień do roota. | Wtyczka LiteSpeed User-End cPanel przed 2.4.5 pozwala na eskalację uprawnień do roota. |
Pilne działanie | 9,8 | 1,01 % | ||
| Windows DWM Core Library Elevation of Privilege Vulnerability | Windows DWM Core Library Elevation of Privilege Vulnerability |
Pilne działanie | 7,8 | 10,95 % | ||
| Podatność w sterowniku Windows Common Log File System umożliwia eskalację uprawnień. | Podatność w sterowniku Windows Common Log File System umożliwia eskalację uprawnień. |
Pilne działanie | 7,8 | 10,85 % | ||
| Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to… | Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code. |
Pilne działanie | 8,8 | 5,83 % | ||
| Luka w Oracle Payments pozwala zdalnie przejąć kontrolę nad systemem. | Luka w Oracle Payments pozwala zdalnie przejąć kontrolę nad systemem. |
Pilne działanie | 9,8 | 0,81 % | ||
| A flaw has been found in Ahsay AhsayCBS up to 10.3.2. | A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack… |
Pilne działanie | 9,3 | 3,24 % | ||
| A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing… | A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user. |
Pilne działanie | 7,2 | 13,7 % | ||
| Błąd w load_elf_binary w jądrze Linux umożliwia atakującym przepełnienie pamięci i wykonanie kodu. | Błąd w load_elf_binary w jądrze Linux umożliwia atakującym przepełnienie pamięci i wykonanie kodu. |
Pilne działanie | 7,8 | 10,7 % | ||
| A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated,… | A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability… |
Pilne działanie | 8,8 | 5,49 % | ||
| A spoofing vulnerability exists when Windows incorrectly validates file signatures. | A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass security features and load improperly signed files. In an attack scenario, an attacker could bypass security features intended to prevent… |
Pilne działanie | 2,1 | 38,95 % | ||
| Błąd w Cisco ASA i FTD umożliwia lokalnemu atakującemu wykonanie dowolnego kodu. | Błąd w Cisco ASA i FTD umożliwia lokalnemu atakującemu wykonanie dowolnego kodu. |
Pilne działanie | 6,0 | 19,43 % | ||
| The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can… | The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieve read/write access to read-only pages. This affects Bifrost r0p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r8p0… |
Pilne działanie | 8,8 | 5,41 % | ||
| A type confusion issue was addressed with improved state handling. | A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7… |
Pilne działanie | 7,8 | 10,34 % | ||
| Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming… | Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets. |
Pilne działanie | 9,3 | 2,77 % | ||
| Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation… | Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe. |
Pilne działanie | 6,5 | 16,74 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.