Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix out-of-bounds read in ext4_read_inline_dir()
ext4_read_inline_dir() can read a dirent header past the end of its inline
buffer, triggering a slab-out-of-bounds read during getdents64():
BUG: KASAN:…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,7 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: validate ef->size covers the record's name and value
When an EA record has a non-zero ef->size, ntfs_read_ea() only checks
that the record fits in the remaining buffer (ea_size > bytes), not that
ef->size is large…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,7 % · rekomendacja wg zapisanej polityki
A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing…
Opis źródłowy NVD · ENCVSS 9,0 · EPSS 1,19 % · rekomendacja wg zapisanej polityki
In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNode.verify() checked a leaf's signature against the signature_key carried in the leaf itself, while the credential's X.509…
Opis źródłowy NVD · ENCVSS 9,2 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,68 % · rekomendacja wg zapisanej polityki
xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any connection mode. A malicious remote VNC server can send crafted image dimensions that cause an integer overflow during memory buffer size…
Opis źródłowy NVD · ENCVSS 9,1 · EPSS 0,67 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix out-of-bounds read in ext4_read_inline_dir()
ext4_read_inline_dir() can read a dirent header past the end of its inline
buffer, triggering a slab-out-of-bounds read during getdents64():
BUG: KASAN:…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,7 % · rekomendacja wg zapisanej polityki
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: validate ef->size covers the record's name and value
When an EA record has a non-zero ef->size, ntfs_read_ea() only checks
that the record fits in the remaining buffer (ea_size > bytes), not that
ef->size is large…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,7 % · rekomendacja wg zapisanej polityki
A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,0 · EPSS 1,19 % · rekomendacja wg zapisanej polityki
In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNode.verify() checked a leaf's signature against the signature_key carried in the leaf itself, while the credential's X.509…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,2 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,68 % · rekomendacja wg zapisanej polityki
xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any connection mode. A malicious remote VNC server can send crafted image dimensions that cause an integer overflow during memory buffer size…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,1 · EPSS 0,67 % · rekomendacja wg zapisanej polityki