KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0.
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate…
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data.…
Podrabianie w instalatorze AppX w Windows umożliwia ataki phishingowe z złośliwymi załącznikami.
An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information. Apple is aware of a report that…
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Deserializacja nieufnych danych w Microsoft Office SharePoint pozwala na zdalne wykonanie kodu.
A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue management for Internet Group Management…
An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0686.
Przepełnienie bufora w oprogramowaniu Zyxel GS1900-48HPv2 umożliwia zdalne wykonanie poleceń.
Nieokreślona podatność w serwerze Commvault umożliwia zdalne przejęcie kontroli przez uwierzytelnionego atakującego.
Błąd odczytu i zapisu poza zakresem w V8 w Google Chrome umożliwia zdalne wykonanie kodu.
Błąd zapisu poza granicami w Skia w Google Chrome umożliwia zdalnemu atakującemu dostęp do pamięci.
Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it consume available memory and eventually…
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5. Processing a maliciously crafted mail message may lead to unexpected memory modification or application termination.
Luka w Windows Update Medic Service pozwala na eskalację uprawnień.
VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers…
Przepełnienie bufora w komponentach POSIX systemów Windows NT i 2000 umożliwia lokalne wykonanie kodu.
A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.
Wykorzystanie luki w jądrze Windows umożliwia eskalację uprawnień.
Windows Mark of the Web Security Feature Bypass Vulnerability
Windows Hyper-V Elevation of Privilege Vulnerability
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP,… | Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface. |
Pilne działanie | 8,8 | 3,19 % | ||
| Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox… | Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Pilne działanie | 8,8 | 3,14 % | ||
| A buffer overflow issue was addressed with improved memory handling. | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.. |
Pilne działanie | 8,8 | 3 % | ||
| . The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root… | . The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0. |
Pilne działanie | 8,8 | 2,99 % | ||
| A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the… | A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate… |
Pilne działanie | 7,8 | 7,88 % | ||
| A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote… | A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of packet data.… |
Pilne działanie | 7,5 | 9,36 % | ||
| Podrabianie w instalatorze AppX w Windows umożliwia ataki phishingowe z złośliwymi załącznikami. | Podrabianie w instalatorze AppX w Windows umożliwia ataki phishingowe z złośliwymi załącznikami. |
Pilne działanie | 7,1 | 11,29 % | ||
| An out-of-bounds read was addressed with improved input validation. | An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information. Apple is aware of a report that… |
Pilne działanie | 6,5 | 14,29 % | ||
| Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap… | Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Pilne działanie | 8,8 | 2,76 % | ||
| Deserializacja nieufnych danych w Microsoft Office SharePoint pozwala na zdalne wykonanie kodu. | Deserializacja nieufnych danych w Microsoft Office SharePoint pozwala na zdalne wykonanie kodu. |
Pilne działanie | 8,8 | 2,7 % | ||
| A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated,… | A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue management for Internet Group Management… |
Pilne działanie | 8,6 | 3,7 % | ||
| An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer… | An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0686. |
Pilne działanie | 7,8 | 7,61 % | ||
| Przepełnienie bufora w oprogramowaniu Zyxel GS1900-48HPv2 umożliwia zdalne wykonanie poleceń. | Przepełnienie bufora w oprogramowaniu Zyxel GS1900-48HPv2 umożliwia zdalne wykonanie poleceń. |
Pilne działanie | 8,8 | 2,5 % | ||
| Nieokreślona podatność w serwerze Commvault umożliwia zdalne przejęcie kontroli przez uwierzytelnionego atakującego. | Nieokreślona podatność w serwerze Commvault umożliwia zdalne przejęcie kontroli przez uwierzytelnionego atakującego. |
Pilne działanie | 8,8 | 2,48 % | ||
| Błąd odczytu i zapisu poza zakresem w V8 w Google Chrome umożliwia zdalne wykonanie kodu. | Błąd odczytu i zapisu poza zakresem w V8 w Google Chrome umożliwia zdalne wykonanie kodu. |
Pilne działanie | 8,8 | 2,44 % | ||
| Błąd zapisu poza granicami w Skia w Google Chrome umożliwia zdalnemu atakującemu dostęp do pamięci. | Błąd zapisu poza granicami w Skia w Google Chrome umożliwia zdalnemu atakującemu dostęp do pamięci. |
Pilne działanie | 8,8 | 2,34 % | ||
| Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an… | Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it consume available memory and eventually… |
Pilne działanie | 8,6 | 3,32 % | ||
| An out-of-bounds write issue was addressed with improved bounds checking. | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5. Processing a maliciously crafted mail message may lead to unexpected memory modification or application termination. |
Pilne działanie | 8,8 | 2,29 % | ||
| Luka w Windows Update Medic Service pozwala na eskalację uprawnień. | Luka w Windows Update Medic Service pozwala na eskalację uprawnień. |
Pilne działanie | 4,6 | 23,27 % | ||
| VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior… | VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers… |
Pilne działanie | 7,8 | 7,25 % | ||
| Przepełnienie bufora w komponentach POSIX systemów Windows NT i 2000 umożliwia lokalne wykonanie kodu. | Przepełnienie bufora w komponentach POSIX systemów Windows NT i 2000 umożliwia lokalne wykonanie kodu. |
Pilne działanie | 7,8 | 7,21 % | ||
| A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0… | A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands. |
Pilne działanie | 7,1 | 10,68 % | ||
| Wykorzystanie luki w jądrze Windows umożliwia eskalację uprawnień. | Wykorzystanie luki w jądrze Windows umożliwia eskalację uprawnień. |
Pilne działanie | 7,2 | 10,17 % | ||
| Windows Mark of the Web Security Feature Bypass Vulnerability | Windows Mark of the Web Security Feature Bypass Vulnerability |
Pilne działanie | 6,5 | 13,63 % | ||
| Windows Hyper-V Elevation of Privilege Vulnerability | Windows Hyper-V Elevation of Privilege Vulnerability |
Pilne działanie | 7,8 | 7,12 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.