KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)
Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Przechowywane XSS w Zimbra Collaboration umożliwia atakującym wykonanie złośliwego kodu w wiadomościach e-mail.
Problem z uwierzytelnieniem w Screen Sharing pozwala atakującemu na dostęp bez ważnych danych.
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update…
Podwójne zwolnienie pamięci w Windows IKE Extension umożliwia zdalne wykonanie kodu.
An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from…
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a Relay Reply denial of service (DoS)…
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected…
Błąd w mechanizmie uwierzytelniania JWT pozwala na nieautoryzowany dostęp do systemu.
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file…
Nieprawidłowe zarządzanie pamięcią w MSXML umożliwia ujawnienie informacji o plikach na dysku.
Luka w kliencie ScreenConnect umożliwia nieautoryzowane przesyłanie i wykonywanie plików w sesji.
Błąd w WebGPU IPC w Firefoxie umożliwia eskalację uprawnień przez wykorzystanie use-after-free.
Złośliwa wersja Nx Console umożliwia potencjalne wprowadzenie niebezpiecznego kodu.
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against…
An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.
W Zammad występuje podatność na przejęcie sesji, co umożliwia zdalne wykonanie kodu jako użytkownik Zammad.
W Adobe Acrobat Reader występuje podatność na zdalne wykonanie kodu przez złośliwe pliki.
"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that…
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due…
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an attacker to manipulate certain agent client components. An attempted attack requires user authentication.
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote… | Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High) |
Pilne działanie | 8,3 | 9,24 % | ||
| Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer… | Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. |
Pilne działanie | 9,6 | 2,73 % | ||
| Przechowywane XSS w Zimbra Collaboration umożliwia atakującym wykonanie złośliwego kodu w wiadomościach e-mail. | Przechowywane XSS w Zimbra Collaboration umożliwia atakującym wykonanie złośliwego kodu w wiadomościach e-mail. |
Pilne działanie | 6,1 | 20,23 % | ||
| Problem z uwierzytelnieniem w Screen Sharing pozwala atakującemu na dostęp bez ważnych danych. | Problem z uwierzytelnieniem w Screen Sharing pozwala atakującemu na dostęp bez ważnych danych. |
Pilne działanie | 9,8 | 1,72 % | ||
| Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption… | Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
Pilne działanie | 8,8 | 6,67 % | ||
| An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially… | An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update… |
Pilne działanie | 9,8 | 1,62 % | ||
| Podwójne zwolnienie pamięci w Windows IKE Extension umożliwia zdalne wykonanie kodu. | Podwójne zwolnienie pamięci w Windows IKE Extension umożliwia zdalne wykonanie kodu. |
Pilne działanie | 9,8 | 1,62 % | ||
| An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this… | An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from… |
Pilne działanie | 7,8 | 11,62 % | ||
| A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP… | A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a Relay Reply denial of service (DoS)… |
Pilne działanie | 8,6 | 7,61 % | ||
| A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an… | A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected… |
Pilne działanie | 8,6 | 7,61 % | ||
| Błąd w mechanizmie uwierzytelniania JWT pozwala na nieautoryzowany dostęp do systemu. | Błąd w mechanizmie uwierzytelniania JWT pozwala na nieautoryzowany dostęp do systemu. |
Pilne działanie | 10,0 | 0,59 % | ||
| A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote… | A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file… |
Pilne działanie | 9,8 | 1,57 % | ||
| Nieprawidłowe zarządzanie pamięcią w MSXML umożliwia ujawnienie informacji o plikach na dysku. | Nieprawidłowe zarządzanie pamięcią w MSXML umożliwia ujawnienie informacji o plikach na dysku. |
Pilne działanie | 6,5 | 18,07 % | ||
| Luka w kliencie ScreenConnect umożliwia nieautoryzowane przesyłanie i wykonywanie plików w sesji. | Luka w kliencie ScreenConnect umożliwia nieautoryzowane przesyłanie i wykonywanie plików w sesji. |
Pilne działanie | 9,9 | 0,92 % | ||
| Błąd w WebGPU IPC w Firefoxie umożliwia eskalację uprawnień przez wykorzystanie use-after-free. | Błąd w WebGPU IPC w Firefoxie umożliwia eskalację uprawnień przez wykorzystanie use-after-free. |
Pilne działanie | 9,6 | 2,35 % | ||
| Złośliwa wersja Nx Console umożliwia potencjalne wprowadzenie niebezpiecznego kodu. | Złośliwa wersja Nx Console umożliwia potencjalne wprowadzenie niebezpiecznego kodu. |
Pilne działanie | 9,8 | 1,34 % | ||
| An out-of-bounds read was addressed with improved input validation. | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against… |
Pilne działanie | 6,5 | 17,82 % | ||
| An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network. | An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network. |
Pilne działanie | 9,8 | 1,3 % | ||
| W Zammad występuje podatność na przejęcie sesji, co umożliwia zdalne wykonanie kodu jako użytkownik Zammad. | W Zammad występuje podatność na przejęcie sesji, co umożliwia zdalne wykonanie kodu jako użytkownik Zammad. |
Pilne działanie | 9,8 | 1,26 % | ||
| W Adobe Acrobat Reader występuje podatność na zdalne wykonanie kodu przez złośliwe pliki. | W Adobe Acrobat Reader występuje podatność na zdalne wykonanie kodu przez złośliwe pliki. |
Pilne działanie | 8,6 | 7,23 % | ||
| "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced… | "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that… |
Pilne działanie | 9,8 | 1,2 % | ||
| A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an… | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due… |
Pilne działanie | 8,6 | 7,19 % | ||
| The vulnerability exists within internal components of BeyondTrust’s Remote Support product. | The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance. |
Pilne działanie | 9,8 | 1,18 % | ||
| Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation… | Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an attacker to manipulate certain agent client components. An attempted attack requires user authentication. |
Pilne działanie | 8,8 | 6,17 % | ||
| A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated… | A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface. |
Pilne działanie | 7,2 | 14,15 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.